Splunk Search

How to disable 'Export Results' for specific users or roles?

Murali2888
Communicator

Hi Splunkers,

I was wondering if there is an option to disable Export Results option for specific users or roles.
Basically, we would like the user not to export the results and use the data in other systems outside the enterprise.

Thanks for your help in advance.

Regards
Murali

1 Solution

MuS
SplunkTrust
SplunkTrust

Hi Murali2888,

I'm not aware if there is a capability http://docs.splunk.com/Documentation/Splunk/6.3.2/Security/Rolesandcapabilities that can be enabled or disabled to achieve this - maybe some else knows better 😉

But you can remove the top right corner export button from a Dashboard with this option

 hideEdit="true" 

see docs http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/PanelreferenceforSimplifiedXML or the button left corner export button from a chart with this option

<option name="link.visible">false</option>

Hope this helps ...

cheers, MuS

View solution in original post

grittonc
Contributor

Please see https://answers.splunk.com/answers/424815/since-splunk-64-some-users-do-not-see-the-export-b.html. There is now a capability called export_results_is_visible that was apparently new in Splunk 6.4. You can take this capability away from roles where you don't want them to be able to export.

0 Karma

niketnilay
Legend

@Murali2888, @dmahler99 I can suggest a rather roundabout way but it will give you control of your Search UI. Following the approach described in one of my previous answers to create Splunk Search UI within a Dashboard using Splunk JS stack and Simple XML JS Extension: https://answers.splunk.com/answers/586948/how-to-change-app-banner-css-when-open-search-in-s.html

This way the Share, Print and Export options will not be available directly and you can link all your dashboards within your App to point to this dashboard with Splunk Search UI for drilldown.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

dmahler99
Explorer

yes - we have a similar need. we want to be able to allow some users to search, but not to be able to export at all. even from the search bar. I am aware of how to inhibit from within a dashboard. sort of the concept of "semi-trusted" search users ?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Murali2888,

I'm not aware if there is a capability http://docs.splunk.com/Documentation/Splunk/6.3.2/Security/Rolesandcapabilities that can be enabled or disabled to achieve this - maybe some else knows better 😉

But you can remove the top right corner export button from a Dashboard with this option

 hideEdit="true" 

see docs http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/PanelreferenceforSimplifiedXML or the button left corner export button from a chart with this option

<option name="link.visible">false</option>

Hope this helps ...

cheers, MuS

View solution in original post

Murali2888
Communicator

Hi Mus,

Thanks for your comments. Unfortunately, we want to disable the Export option in the default search window for a user.
But its good to know these options 🙂

0 Karma

abilash2
New Member

In Settings Go to roles and create a role, then inherit user or poweruser to it.

There is a option called export_results_is_visible in Capabilities of that role just disable it.

Hope it helps...

0 Karma

grittonc
Contributor

If you still have this need, there's a new capability in Splunk 6.4 that will allow this.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.