For certain users, we do not want them to drilldown in the Splunk Search window, and for another set of users we do want that functionality.
Is there a role or conf file setting we can use to limit as specific group of users from getting to the search UI when a specific drilldown is not specified for a chart?
Most of our drilldowns go to other dashboards in our Splunk app. But some go directly into Splunk search that generated the chart, because we have not provided specific drilldown behavior. For our admin users, this is the functionality we want. But for non-Admin users, we do not want to expose the search to them.
AFAIK there is no way to restrict this by role.
Either the dashboard panel has drilldown enabled or it does not. You could have 2 versions of the dashboard... that's a pain, but I don't have another idea for you.