Is it possible to restrict a user from creating reports, alerts and dashboards from within the search & reporting app? or limiting creation to an app of an admins choosing?
Our splunk platform has multiple apps built within it for specific areas of the business however in the past, certain departments have created dashboards outside of their area which has been a pain to manage and is generally untidy.
I'm not aware of ways to prevent users from creating knowledge objects in apps in which they have write access. There are a couple of things you can do to help, though.
1) Create an app for each department and make it the default app for users in that department.
2) Hide the Search & Reporting app to make it harder for users to use.