How can we prevent users from creating knowledge objects within the Search app?

[ddrillic]

A similar question as in Is there a way to prevent users from saving knowledge objects in the Searching and Reporting app

We want to avoid all users except the admin ones from creating any knowledge objects within the Search app, including private ones.
Is it possible?

[woodcock]

Here are some ideas:

1: Remove the capability to save knowledge objects entirely. When users request this capability, force them to complete your training course WHICH INCLUDES THIS PROHIBITION. Give those who pass the class/test the capability.

2: Create a cron job on the search head that removes/moves everything in the local directory every night. Users can save KOs, but they will not live very long.

[ddrillic]

Interesting thing @woodcock.

-- 1: Remove the capability to save knowledge objects entirely.
Where exactly?

-- 2: it's pretty sad that we need to do something like this in the back-end...

[woodcock]

Go to Settings -> Access controls -> Users and Roles.

[ddrillic]

Meaning, preventing them from creating any knowledge objects in any app? that's a bit much...

[ddrillic]

@woodcock, option #1 seems a bit excessive and option #2 hard to implement.

[woodcock]

Option #2 is trivial; cron this (WITH MUCH TESTING AND MODIFIED FOR EXCEPTIONS):

find /opt/splunk/etc/apps/*/local/*.conf -delete

Users can save in their personal space because that writes to /opt/splunk/etc/users/....

[wryanthomas]

Re Option #1: I'm not seeing a discrete capability that maps to the ability to create "private" knowledge objects. If there is one, what capability is it?

PS Thanks for option #2. We may use that. I'd still rather prevent the ability to create / clone stuff (as private) for accounts where all we want them to do is to view dashboards.