Splunk Search

Is there a `umask` setting for splunk objects? (Default object permission)

Lowell
Super Champion

Is it possible to tell splunk what the default permissions should be when an object is created from the Splunk UI?

The best analogy I could think of is the unix "umask" tool that sets a mask for which permissions can be given to a newly created file by default. I'm wondering if there is any such concepts for objects created from within splunk.

For example, new objects are created privately by default. Which works well for many things, but it can be a serious pain when creating new tags, for example. (And even worse when tagging a newly created eventtype.) So is it possible to setup splunk to make tags application-level (or global-level) when they are created, instead of making them private by default?

I know you can setup a default.meta in your own custom app with something like this:

[tags]
access = read : [ * ], write : [ power ]
export = system

Which will make any existing tag in tags.conf (that have no explicit meta entry) readable to all, across all apps, and modifying to the "power" role, however newly created tags are just private. Can this be configured?

Tags (3)

carasso
Splunk Employee
Splunk Employee

It's a good suggestion.

Somewhat related -- in Splunk 4.2, the Saved Search dialog allows you to specify the permissions. You can specify either:

  • Keep search private
  • Share as read-only to all users of current app
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...