Splunk Search

How to disable 'Export Results' for specific users or roles?

Communicator

Hi Splunkers,

I was wondering if there is an option to disable Export Results option for specific users or roles.
Basically, we would like the user not to export the results and use the data in other systems outside the enterprise.

Thanks for your help in advance.

Regards
Murali

1 Solution

SplunkTrust
SplunkTrust

Hi Murali2888,

I'm not aware if there is a capability http://docs.splunk.com/Documentation/Splunk/6.3.2/Security/Rolesandcapabilities that can be enabled or disabled to achieve this - maybe some else knows better 😉

But you can remove the top right corner export button from a Dashboard with this option

 hideEdit="true" 

see docs http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/PanelreferenceforSimplifiedXML or the button left corner export button from a chart with this option

<option name="link.visible">false</option>

Hope this helps ...

cheers, MuS

View solution in original post

Contributor

Please see https://answers.splunk.com/answers/424815/since-splunk-64-some-users-do-not-see-the-export-b.html. There is now a capability called export_results_is_visible that was apparently new in Splunk 6.4. You can take this capability away from roles where you don't want them to be able to export.

0 Karma

Legend

@Murali2888, @dmahler99 I can suggest a rather roundabout way but it will give you control of your Search UI. Following the approach described in one of my previous answers to create Splunk Search UI within a Dashboard using Splunk JS stack and Simple XML JS Extension: https://answers.splunk.com/answers/586948/how-to-change-app-banner-css-when-open-search-in-s.html

This way the Share, Print and Export options will not be available directly and you can link all your dashboards within your App to point to this dashboard with Splunk Search UI for drilldown.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Explorer

yes - we have a similar need. we want to be able to allow some users to search, but not to be able to export at all. even from the search bar. I am aware of how to inhibit from within a dashboard. sort of the concept of "semi-trusted" search users ?

0 Karma

SplunkTrust
SplunkTrust

Hi Murali2888,

I'm not aware if there is a capability http://docs.splunk.com/Documentation/Splunk/6.3.2/Security/Rolesandcapabilities that can be enabled or disabled to achieve this - maybe some else knows better 😉

But you can remove the top right corner export button from a Dashboard with this option

 hideEdit="true" 

see docs http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/PanelreferenceforSimplifiedXML or the button left corner export button from a chart with this option

<option name="link.visible">false</option>

Hope this helps ...

cheers, MuS

View solution in original post

Communicator

Hi Mus,

Thanks for your comments. Unfortunately, we want to disable the Export option in the default search window for a user.
But its good to know these options 🙂

0 Karma

Contributor

If you still have this need, there's a new capability in Splunk 6.4 that will allow this.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!