"Event Action" button not displayed for some users

[robgarner]

I use Splunk as an admin and most of my users are power users. Following a syntactically valid search, a list of matching events is available to the user (so far, so normal). When an event is expanded, there is an 'Event Actions' button that allows users to, among other things, view the raw event.

Some of my users report that they don't have this button.

Because we have a Gordian knot of LDAP and AD authentication mechanisms, overlapping and inherited roles, and opaque role-index mappings, i can't easily figure out what makes those particular users different from the rest.

Question: Is it possible to construct a role that prevents the "Event Actions" button from being displayed ?

[robgarner · Accepted solution]

I failed to be explicit in my question: I was trying to determine if it was possible for some previous admin to have modified a role to selectively revoke or hide the "event actions" button (as opposed to asking how I would accomplish such a thing myself).

In the end, it was a PEBKAC problem - the user had forgotten where the UI the button was located. Panic can make all kinds of familiar things feel alien.

Thanks for the comment about constructing roles, though !
-Rob

[isoutamo]

And maybe also this can be the reason why you see it some times and some other time not. It depends which kind of time frame you are using on your search. If you are using real-time search then this button isn't there, but all other cases it is.

--
Ismo

[woodcock]

No. Permissions Inherited from roles CANNOT be dis-inherited. You will need to create find the permission that enables this, create a role that has ONLY this permission, remove this permission from all other roles, then selectively add the new role to the users/roles that should have it.