Splunk Search

How to disable default drilldown in the search window for certain users?

simpkins1958
Contributor

For certain users, we do not want them to drilldown in the Splunk Search window, and for another set of users we do want that functionality.

Is there a role or conf file setting we can use to limit as specific group of users from getting to the search UI when a specific drilldown is not specified for a chart?

Most of our drilldowns go to other dashboards in our Splunk app. But some go directly into Splunk search that generated the chart, because we have not provided specific drilldown behavior. For our admin users, this is the functionality we want. But for non-Admin users, we do not want to expose the search to them.

0 Karma
1 Solution

lguinn2
Legend

AFAIK there is no way to restrict this by role.
Either the dashboard panel has drilldown enabled or it does not. You could have 2 versions of the dashboard... that's a pain, but I don't have another idea for you.

View solution in original post

0 Karma

lguinn2
Legend

AFAIK there is no way to restrict this by role.
Either the dashboard panel has drilldown enabled or it does not. You could have 2 versions of the dashboard... that's a pain, but I don't have another idea for you.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...