Changing permissions for multiple eventtypes

[hmallett]

I have been using Splunk for a few months, and now have a number of eventtypes defined. However, they've all got private permissions (the default), and we've now discovered that they should be shared within the search app for our needs.

I know I can change the permissions on each eventtype individually, but is there a quicker way to change the permissions for multiple objects?

[jbsplunk · Accepted solution]

Permissions are set on a per object basis, so they do need to be changed individually. There isn't a global permissions feature that would allow you to change a particular subset of permissions in an automated fashion. You may be able to script something to look at the local.meta file in the metadata folder of the app/user directory where the object exists, but you'd obviously need to do that outside of the product itself.

[sansay]

I do not find this answer acceptable. It is a royal pain to have to click twice on every single knowledge object to change the same setting. Due to our users creating dangerous dashboards for splunk performance, we are forced to control the privileges for every single knowledge object they create. As a result I spend so much time just changing permissions on sometimes more than 50 objects. It's ridiculous. And this is only talking about permissions. What about enabling, disabling, moving, deleting?
One should be able select them and apply the same setting to all selected KO with just one click. This is what I call "intuitive GUI design".
Furthermore, I am writing this today October 4th, 2017, and this was asked in 2012, so 5 years later and still nothing done to improve this. I saw at the conference in 2016 someone demonstrating what I just described, but for some mysterious reason, it never made it in the last version. I would love to know why.