Permission for creating saved searches

[nebel]

Hi there,

we do have integrated our domain controller via LDAP on our Splunk Server. It works great.

We have a hand full of users for them it is now allowed to save their searches. Means, they can entry Splunk, can use the search box but the searches can not be saved.

Is there a way to deny saving searches for them? Is there a special capability?

Thanks in advance

[nebel · Accepted solution]

Hi,

yes I know this point.
We will realize this with a new search app. In this app all points where you can save something will be disabled.

Thanks anyway!

[sdaniels]

There is a Role capability to limit users from scheduling searches but i don't believe there is one that limits a user from saving a search. If you are worried about inefficient searches you can always pre-pend a search to your roles limiting the data for a search.

Search restrictions
Restrict the scope of searches run by this role. Search results for this role will only show events that also match this search string.

You can limit the timeframe for a role and also the amount of concurrent searches for a role. Take a look under Manager->Access Controls->Roles and then pick a role.