yes - we have a similar need. we want to be able to allow some users to search, but not to be able to export at all. even from the search bar. I am aware of how to inhibit from within a dashboard. sort of the concept of "semi-trusted" search users ? ... View more

to completely refresh and clean notable events , you can do the following (try this in test first, not prod) : How to wipe all events from indexes and kvstores and start over $SPLUNK_HOME/bin/splunk stop $SPLUNK_HOME/bin/splunk clean eventdata -index itsi_tracked_alerts; $SPLUNK_HOME/bin/splunk clean eventdata -index itsi_grouped_alerts; $SPLUNK_HOME/bin/splunk start $SPLUNK_HOME/bin/splunk clean kvstore -app SA-ITOA -collection itsi_notable_event_group $SPLUNK_HOME/bin/splunk clean kvstore -app SA-ITOA -collection itsi_notable_event_state $SPLUNK_HOME/bin/splunk clean kvstore -app SA-ITOA -collection itsi_notable_event_tag $SPLUNK_HOME/bin/splunk clean kvstore -app SA-ITOA -collection itsi_notable_event_comment $SPLUNK_HOME/bin/splunk clean kvstore -app SA-ITOA -collection itsi_notable_event_ticketing ... View more

the export of the user password into environment variables worked great... thanks ... View more

that worked great... thanks ... View more