Alerting

How do you restrict users roles/capabilities with cron expressions?

inventsekar
Super Champion

Hi,

Many times, our users create alerts/reports with the cron expression as * * * * * or */1* * * *.

And we have to chase the users with back and forth emails and lots of confusion.

So, to avoid these issues, it would be better that if we could restrict users by their roles/capabilities with the cron expressions.

Please if you have some ideas/workarounds.

0 Karma
1 Solution

inventsekar
Super Champion

one idea would be ...

From Answer by @the_wolverine and @strive
Set the capabilities for roles in authorize.conf configuration file

[capability::schedule_search]
schedule_search = disabled

(requires save and restart)
Note:
By default all the capabilities are disabled.
Roles inherit all capabilities from imported roles, and inherited capabilities cannot be disabled.

From - https://answers.splunk.com/answers/150358/how-to-limit-some-user-roles-from-running-scheduled-search...

View solution in original post

0 Karma

inventsekar
Super Champion

Hi All... any suggestions, ideas please

0 Karma

inventsekar
Super Champion

Hi All... any suggestions, ideas please..

0 Karma

inventsekar
Super Champion

one idea would be ...

From Answer by @the_wolverine and @strive
Set the capabilities for roles in authorize.conf configuration file

[capability::schedule_search]
schedule_search = disabled

(requires save and restart)
Note:
By default all the capabilities are disabled.
Roles inherit all capabilities from imported roles, and inherited capabilities cannot be disabled.

From - https://answers.splunk.com/answers/150358/how-to-limit-some-user-roles-from-running-scheduled-search...

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!