Splunk Search

Is there a `umask` setting for splunk objects? (Default object permission)

Lowell
Super Champion

Is it possible to tell splunk what the default permissions should be when an object is created from the Splunk UI?

The best analogy I could think of is the unix "umask" tool that sets a mask for which permissions can be given to a newly created file by default. I'm wondering if there is any such concepts for objects created from within splunk.

For example, new objects are created privately by default. Which works well for many things, but it can be a serious pain when creating new tags, for example. (And even worse when tagging a newly created eventtype.) So is it possible to setup splunk to make tags application-level (or global-level) when they are created, instead of making them private by default?

I know you can setup a default.meta in your own custom app with something like this:

[tags]
access = read : [ * ], write : [ power ]
export = system

Which will make any existing tag in tags.conf (that have no explicit meta entry) readable to all, across all apps, and modifying to the "power" role, however newly created tags are just private. Can this be configured?

Tags (3)

carasso
Splunk Employee
Splunk Employee

It's a good suggestion.

Somewhat related -- in Splunk 4.2, the Saved Search dialog allows you to specify the permissions. You can specify either:

  • Keep search private
  • Share as read-only to all users of current app
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...