Splunk Search

How to protect from anyone creating lookup tables with outputlookup?

sgarvin55
Splunk Employee
Splunk Employee

It seems anyone can create a new lookup table, or overwrite an existing one's content. Is there a way to set permissions for this functionality?

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

In order to keep users from creating non-existing lookup tables using outputlookup, the command would need to be defined in commands.conf, which would allow role-based permissions to be set. This doesn't seem to be the case, but keep in mind that outputlookup can only write to $SPLUNK_HOME/etc/system/lookups or to $SPLUNK_HOME/etc/apps/{app}/lookups

As for overwriting other users lookup tables with it, you should be able to prevent this by denying write permissions (in Splunk) to the tables that you don't want anyone messing with.

View solution in original post

hexx
Splunk Employee
Splunk Employee

In order to keep users from creating non-existing lookup tables using outputlookup, the command would need to be defined in commands.conf, which would allow role-based permissions to be set. This doesn't seem to be the case, but keep in mind that outputlookup can only write to $SPLUNK_HOME/etc/system/lookups or to $SPLUNK_HOME/etc/apps/{app}/lookups

As for overwriting other users lookup tables with it, you should be able to prevent this by denying write permissions (in Splunk) to the tables that you don't want anyone messing with.

raziasaduddin
Path Finder

We just tested in 5.0.2.2 - A user did outputlookup and overwrote a lookup file in etc/system even though in the UI, users only have read access to the table definition and file. This is unacceptable. To be clear, the files have no owner since they were just created via editing transforms.conf and the lookup csv files themselves in the command line.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...