Alerting

How do you restrict users roles/capabilities with cron expressions?

inventsekar
SplunkTrust
SplunkTrust

Hi,

Many times, our users create alerts/reports with the cron expression as * * * * * or */1* * * *.

And we have to chase the users with back and forth emails and lots of confusion.

So, to avoid these issues, it would be better that if we could restrict users by their roles/capabilities with the cron expressions.

Please if you have some ideas/workarounds.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

one idea would be ...

From Answer by @the_wolverine and @strive
Set the capabilities for roles in authorize.conf configuration file

[capability::schedule_search]
schedule_search = disabled

(requires save and restart)
Note:
By default all the capabilities are disabled.
Roles inherit all capabilities from imported roles, and inherited capabilities cannot be disabled.

From - https://answers.splunk.com/answers/150358/how-to-limit-some-user-roles-from-running-scheduled-search...

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi All... any suggestions, ideas please

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi All... any suggestions, ideas please..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

inventsekar
SplunkTrust
SplunkTrust

one idea would be ...

From Answer by @the_wolverine and @strive
Set the capabilities for roles in authorize.conf configuration file

[capability::schedule_search]
schedule_search = disabled

(requires save and restart)
Note:
By default all the capabilities are disabled.
Roles inherit all capabilities from imported roles, and inherited capabilities cannot be disabled.

From - https://answers.splunk.com/answers/150358/how-to-limit-some-user-roles-from-running-scheduled-search...

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...