Splunk Search

How can we prevent users from creating knowledge objects within the Search app?

Ultra Champion

A similar question as in Is there a way to prevent users from saving knowledge objects in the Searching and Reporting app

We want to avoid all users except the admin ones from creating any knowledge objects within the Search app, including private ones.
Is it possible?

0 Karma

Esteemed Legend

Here are some ideas:

1: Remove the capability to save knowledge objects entirely. When users request this capability, force them to complete your training course WHICH INCLUDES THIS PROHIBITION. Give those who pass the class/test the capability.

2: Create a cron job on the search head that removes/moves everything in the local directory every night. Users can save KOs, but they will not live very long.

Ultra Champion

Interesting thing @woodcock.

-- 1: Remove the capability to save knowledge objects entirely.
Where exactly?

-- 2: it's pretty sad that we need to do something like this in the back-end...

0 Karma

Esteemed Legend

Go to Settings -> Access controls -> Users and Roles.

0 Karma

Ultra Champion

Meaning, preventing them from creating any knowledge objects in any app? that's a bit much...

0 Karma

Ultra Champion

@woodcock, option #1 seems a bit excessive and option #2 hard to implement.

0 Karma

Esteemed Legend

Option #2 is trivial; cron this (WITH MUCH TESTING AND MODIFIED FOR EXCEPTIONS):

find /opt/splunk/etc/apps/*/local/*.conf -delete

Users can save in their personal space because that writes to /opt/splunk/etc/users/....

0 Karma

Communicator

Re Option #1: I'm not seeing a discrete capability that maps to the ability to create "private" knowledge objects. If there is one, what capability is it?

PS Thanks for option #2. We may use that. I'd still rather prevent the ability to create / clone stuff (as private) for accounts where all we want them to do is to view dashboards.

0 Karma