Security

Using import and export attributes in default.meta

ruchir
Explorer

Hi

I want to import a specific view(dashboard) in an app from another app having that particular view with permission as (This app only).
How to use import and export attributes in default.meta?

For e.g. app App1 is having view View1 with permission as This app only. I want to use this View1 in app App2 without making View1 as global. I want that only specific apps can use this View1.

How to configure default.meta to make this possible by using attributes import and export?

Thanks in advance 🙂

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The way I understand it, you can set import = theotherapp in your app to make theotherapp part of your app's namespace.
Setting export = system in theotherapp would make it globally shared, so that's not what you want.

This should be in http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Defaultmetaconf but isn't - do use the feedback box at the bottom of that page to get this added.

View solution in original post

evilgeorge
Explorer

If "import" is part of the *.meta spec, can we please get it documented?

martin_mueller
SplunkTrust
SplunkTrust

The way I understand it, you can set import = theotherapp in your app to make theotherapp part of your app's namespace.
Setting export = system in theotherapp would make it globally shared, so that's not what you want.

This should be in http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Defaultmetaconf but isn't - do use the feedback box at the bottom of that page to get this added.

samhughe
Path Finder

I know this is an old thread, but in case it helps anyone else, this does work (in 6.3.3) but you have to import the 'search' app as well. It seems that the import command overrides rather than appends to a hidden default where all apps import the 'search' app. Without including the 'search' app in the import I got errors trying to load the default search/flashtimeline page in the top level app.

martin_mueller
SplunkTrust
SplunkTrust

Apps should not influence the indexes searched.

Check your roles, do they have restrictions on the indexes searchable or searched by default?
Check your searches, do they specify indexes or rely on the indexes searched by default settings in the roles?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That looks just like what's working over here in default.meta, so I can't give you a different example.

This app uses the import statement as well: https://apps.splunk.com/app/1632/

ruchir
Explorer

Thanks Martin, it was helpful.
Now I'm able to import views in an app from another.

But now the app which imports other app is unable to search anything the way it used to.
It's only searching main Index. I want to search other indexes available but unable to do that. Seems like importing an app limits the data you can query. Is there any way by which I can resolve this so that I can query all the data available?

0 Karma

ruchir
Explorer

Thank you Martin.

I tried it but wasn't able to get it right. I updated default.meta of App2 as:

[]
import = App1

Its not working.

May be I'm not using the right syntax to import App1's view1 view in App2. It'll be great if you can help me with an example.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...