Security

Is it possible to give users the ability to modify the search string for an existing scheduled search without being able to change its schedule or create new ones?

mlf
Path Finder

I'm looking for a way to give a set of users the ability to modify an existing scheduled search's search string, without being able to change its schedule or create new scheduled searches. Based on what I know of the current capabilities, this doesn't seem possible since Splunk won't let you modify a scheduled search without the schedule_search capability, which would give them full add/change/delete of any scheduled search. Can anyone prove me wrong?

1 Solution

sideview
SplunkTrust
SplunkTrust

I would turn the key part, or parts of the search into a search macro, and then give them broader access to change that macro without changing the search.

Be mindful of permissions and sharing on that macro of course, so that it's available to the scheduled search when the time comes, but this should work fine.

http://docs.splunk.com/Documentation/Splunk/6.2.5/Search/Usesearchmacros

View solution in original post

0 Karma

woodcock
Esteemed Legend

I agree with @sideview; this can also be done with eventtypes (which are macro-tized base searches) if you do not have any pipes in your search.

0 Karma

sideview
SplunkTrust
SplunkTrust

I would turn the key part, or parts of the search into a search macro, and then give them broader access to change that macro without changing the search.

Be mindful of permissions and sharing on that macro of course, so that it's available to the scheduled search when the time comes, but this should work fine.

http://docs.splunk.com/Documentation/Splunk/6.2.5/Search/Usesearchmacros

0 Karma

mlf
Path Finder

Not ideal, but probably the best work around available currently within Splunk itself. What I really need is

  1. Separate ability in the GUI for editing a saved search and the saved searche's schedule.
  2. The ability to assign capabilities to roles on a per app basis.

I'm actually thinking of throwing some custom code in front of the REST interface to handle this particular case outside of the Splunk GUI.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...