Splunk Search

"Event Action" button not displayed for some users

robgarner
Path Finder

I use Splunk as an admin and most of my users are power users. Following a syntactically valid search, a list of matching events is available to the user (so far, so normal). When an event is expanded, there is an 'Event Actions' button that allows users to, among other things, view the raw event.

Some of my users report that they don't have this button.

Because we have a Gordian knot of LDAP and AD authentication mechanisms, overlapping and inherited roles, and opaque role-index mappings, i can't easily figure out what makes those particular users different from the rest.

Question: Is it possible to construct a role that prevents the "Event Actions" button from being displayed ?

0 Karma
1 Solution

robgarner
Path Finder

I failed to be explicit in my question: I was trying to determine if it was possible for some previous admin to have modified a role to selectively revoke or hide the "event actions" button (as opposed to asking how I would accomplish such a thing myself).

In the end, it was a PEBKAC problem - the user had forgotten where the UI the button was located. Panic can make all kinds of familiar things feel alien.

Thanks for the comment about constructing roles, though !
-Rob

View solution in original post

0 Karma

robgarner
Path Finder

I failed to be explicit in my question: I was trying to determine if it was possible for some previous admin to have modified a role to selectively revoke or hide the "event actions" button (as opposed to asking how I would accomplish such a thing myself).

In the end, it was a PEBKAC problem - the user had forgotten where the UI the button was located. Panic can make all kinds of familiar things feel alien.

Thanks for the comment about constructing roles, though !
-Rob

0 Karma

isoutamo
SplunkTrust
SplunkTrust

And maybe also this can be the reason why you see it some times and some other time not. It depends which kind of time frame you are using on your search. If you are using real-time search then this button isn't there, but all other cases it is.

--
Ismo

0 Karma

woodcock
Esteemed Legend

No. Permissions Inherited from roles CANNOT be dis-inherited. You will need to create find the permission that enables this, create a role that has ONLY this permission, remove this permission from all other roles, then selectively add the new role to the users/roles that should have it.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...