Reporting

How to save a search in an app instead of user setting

zscgeek
Path Finder

When saving a search in the UI (on splunk 4.1.2) via the action menu the search is always saved in the user context (etc/users/$username/search/local/savedsearches.conf).

How can I force it to be shared between users into one of the apps (eg etc/apps/search/local/savedsearches.conf)?

I tried going into the manager page after the fact to change the ownership settings but it's not listed there. The only way I was able to move it into a shared context was to edit the conf files by hand.

Tags (2)
1 Solution

zscgeek
Path Finder

Turns out the problem is that if you are using scripted auth and don't return a complete list of users that have logged into the UI in the listUsers() function saved searches are not visible in the UI. The fix was to go in and update the script to list users who have logged in using this script:

def getUsers( args ):
   out = "--status=success"
   path="/opt/splunk/etc/users/"
   dirList=os.listdir(path)
   for u in dirList:
     if (u!="users.ini"):
       out += ' --userInfo=' + u + ';' + u + ';' + u + ';' + ':admin'
   print out

View solution in original post

zscgeek
Path Finder

Turns out the problem is that if you are using scripted auth and don't return a complete list of users that have logged into the UI in the listUsers() function saved searches are not visible in the UI. The fix was to go in and update the script to list users who have logged in using this script:

def getUsers( args ):
   out = "--status=success"
   path="/opt/splunk/etc/users/"
   dirList=os.listdir(path)
   for u in dirList:
     if (u!="users.ini"):
       out += ' --userInfo=' + u + ';' + u + ';' + u + ';' + ':admin'
   print out

Genti
Splunk Employee
Splunk Employee

By going to Permissions and choosing the ALL APPS option you can set the permission to the specific app only or globally...
Furthermore, you should allow everyone to READ and the owner only to Write.

Otherwise just cut and paste the .conf file as you already have done..

Hope this helps,
.gz

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...