Security

How to change the permissions for a report to private after packaging a Splunk app?

adevi
Explorer

I have packaged my Splunk app using the package app command and it had copied all my saved searches from the local to the default directory of the app. I think because of that, I am not able to delete the report from the UI. There is no delete option even though I am an admin and have write permissions to the app and the report I am trying to delete. Since I cannot delete the report, I thought of making it private, but that option is also grayed out.

Does that mean my only option is to remove the report from default/savedsearches.conf? Is it ok to do that way? Because I read it is not good to modify the default conf files. Any other ideas?

I read the below the doc - disable or delete knowledge object and I understand that I can disable it. But I would like to make it private or delete it so that it would not get into the production environment ( not listed in the reports tab) when I package it.

Thanks in advance!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It's OK to modify default conf files as long as you understand you will have to do so every time you re-package the app.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It's OK to modify default conf files as long as you understand you will have to do so every time you re-package the app.

---
If this reply helps you, Karma would be appreciated.

adevi
Explorer

Is it like that in all versions? once you package the app and install , then you wont be allowed to delete anything from web gui or even change to private? Then why are we giving admin user delete option when they cannot really delete it ? I am confused

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...