Splunk Search

How to protect from anyone creating lookup tables with outputlookup?

sgarvin55
Splunk Employee
Splunk Employee

It seems anyone can create a new lookup table, or overwrite an existing one's content. Is there a way to set permissions for this functionality?

Tags (1)
1 Solution

hexx
Splunk Employee
Splunk Employee

In order to keep users from creating non-existing lookup tables using outputlookup, the command would need to be defined in commands.conf, which would allow role-based permissions to be set. This doesn't seem to be the case, but keep in mind that outputlookup can only write to $SPLUNK_HOME/etc/system/lookups or to $SPLUNK_HOME/etc/apps/{app}/lookups

As for overwriting other users lookup tables with it, you should be able to prevent this by denying write permissions (in Splunk) to the tables that you don't want anyone messing with.

View solution in original post

hexx
Splunk Employee
Splunk Employee

In order to keep users from creating non-existing lookup tables using outputlookup, the command would need to be defined in commands.conf, which would allow role-based permissions to be set. This doesn't seem to be the case, but keep in mind that outputlookup can only write to $SPLUNK_HOME/etc/system/lookups or to $SPLUNK_HOME/etc/apps/{app}/lookups

As for overwriting other users lookup tables with it, you should be able to prevent this by denying write permissions (in Splunk) to the tables that you don't want anyone messing with.

raziasaduddin
Path Finder

We just tested in 5.0.2.2 - A user did outputlookup and overwrote a lookup file in etc/system even though in the UI, users only have read access to the table definition and file. This is unacceptable. To be clear, the files have no owner since they were just created via editing transforms.conf and the lookup csv files themselves in the command line.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...