Splunk Search

"Event Action" button not displayed for some users

robgarner
Path Finder

I use Splunk as an admin and most of my users are power users. Following a syntactically valid search, a list of matching events is available to the user (so far, so normal). When an event is expanded, there is an 'Event Actions' button that allows users to, among other things, view the raw event.

Some of my users report that they don't have this button.

Because we have a Gordian knot of LDAP and AD authentication mechanisms, overlapping and inherited roles, and opaque role-index mappings, i can't easily figure out what makes those particular users different from the rest.

Question: Is it possible to construct a role that prevents the "Event Actions" button from being displayed ?

0 Karma
1 Solution

robgarner
Path Finder

I failed to be explicit in my question: I was trying to determine if it was possible for some previous admin to have modified a role to selectively revoke or hide the "event actions" button (as opposed to asking how I would accomplish such a thing myself).

In the end, it was a PEBKAC problem - the user had forgotten where the UI the button was located. Panic can make all kinds of familiar things feel alien.

Thanks for the comment about constructing roles, though !
-Rob

View solution in original post

0 Karma

robgarner
Path Finder

I failed to be explicit in my question: I was trying to determine if it was possible for some previous admin to have modified a role to selectively revoke or hide the "event actions" button (as opposed to asking how I would accomplish such a thing myself).

In the end, it was a PEBKAC problem - the user had forgotten where the UI the button was located. Panic can make all kinds of familiar things feel alien.

Thanks for the comment about constructing roles, though !
-Rob

0 Karma

isoutamo
SplunkTrust
SplunkTrust

And maybe also this can be the reason why you see it some times and some other time not. It depends which kind of time frame you are using on your search. If you are using real-time search then this button isn't there, but all other cases it is.

--
Ismo

0 Karma

woodcock
Esteemed Legend

No. Permissions Inherited from roles CANNOT be dis-inherited. You will need to create find the permission that enables this, create a role that has ONLY this permission, remove this permission from all other roles, then selectively add the new role to the users/roles that should have it.

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...