Splunk Search

How to disable default drilldown in the search window for certain users?

simpkins1958
Contributor

For certain users, we do not want them to drilldown in the Splunk Search window, and for another set of users we do want that functionality.

Is there a role or conf file setting we can use to limit as specific group of users from getting to the search UI when a specific drilldown is not specified for a chart?

Most of our drilldowns go to other dashboards in our Splunk app. But some go directly into Splunk search that generated the chart, because we have not provided specific drilldown behavior. For our admin users, this is the functionality we want. But for non-Admin users, we do not want to expose the search to them.

0 Karma
1 Solution

lguinn2
Legend

AFAIK there is no way to restrict this by role.
Either the dashboard panel has drilldown enabled or it does not. You could have 2 versions of the dashboard... that's a pain, but I don't have another idea for you.

View solution in original post

0 Karma

lguinn2
Legend

AFAIK there is no way to restrict this by role.
Either the dashboard panel has drilldown enabled or it does not. You could have 2 versions of the dashboard... that's a pain, but I don't have another idea for you.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!