How to disable 'Export Results' for specific users or roles?

[Murali2888]

Hi Splunkers,

I was wondering if there is an option to disable Export Results option for specific users or roles.
Basically, we would like the user not to export the results and use the data in other systems outside the enterprise.

Thanks for your help in advance.

Regards
Murali

[grittonc]

Please see https://answers.splunk.com/answers/424815/since-splunk-64-some-users-do-not-see-the-export-b.html. There is now a capability called export_results_is_visible that was apparently new in Splunk 6.4. You can take this capability away from roles where you don't want them to be able to export.

[niketn]

@Murali2888, @dmahler99 I can suggest a rather roundabout way but it will give you control of your Search UI. Following the approach described in one of my previous answers to create Splunk Search UI within a Dashboard using Splunk JS stack and Simple XML JS Extension: https://answers.splunk.com/answers/586948/how-to-change-app-banner-css-when-open-search-in-s.html

This way the Share, Print and Export options will not be available directly and you can link all your dashboards within your App to point to this dashboard with Splunk Search UI for drilldown.

[dmahler99]

yes - we have a similar need. we want to be able to allow some users to search, but not to be able to export at all. even from the search bar. I am aware of how to inhibit from within a dashboard. sort of the concept of "semi-trusted" search users ?

[MuS · Accepted solution]

Hi Murali2888,

I'm not aware if there is a capability http://docs.splunk.com/Documentation/Splunk/6.3.2/Security/Rolesandcapabilities that can be enabled or disabled to achieve this - maybe some else knows better 😉

But you can remove the top right corner export button from a Dashboard with this option

 hideEdit="true" 

see docs http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/PanelreferenceforSimplifiedXML or the button left corner export button from a chart with this option

<option name="link.visible">false</option>

Hope this helps ...

cheers, MuS

[Murali2888]

Hi Mus,

Thanks for your comments. Unfortunately, we want to disable the Export option in the default search window for a user.
But its good to know these options 🙂

[abilash2]

In Settings Go to roles and create a role, then inherit user or poweruser to it.

There is a option called export_results_is_visible in Capabilities of that role just disable it.

Hope it helps...

[grittonc]

If you still have this need, there's a new capability in Splunk 6.4 that will allow this.