Share a saved search without admin rights?

[wegordoniii]

I have a group of splunk users that need to be able to create & share queries with one another. Unlike the older version of splunk, when a user saves a search it's made private and they aren't given an option to share it with others. The documentation on sharing saved searches assumes that you're an Administrator, but I need users without the Administrative role to be able to share saved searches.

Is it possible for a non-admin Splunk User to share a saved search with other non-admin Splunk Users without the intervention of a Splunk Administrator?

Thank you

[woodcock]

This Q&A has a link to the docs with the full details/answer:

https://answers.splunk.com/answers/56276/what-capabilities-do-i-need-to-enable-so-a-user-can-change-...

[tuinteractive]

no written docs sadly, but I was able to get some good info from support on this. the "write" bit for a user/role on the search app just lets them then modify attribute for their search. so lets them share their searches for example.

the user then can control on a given search who they want to read/write THAT search. read on the search lets folks run it. write let's them modify it.

So an example. say you have Bob,Mary in Role1, Joe,Gary in Role2. giving Role1,Role2 write access to "search app" just let's them share their objects. it does not give them global "write" access to ALL of search. which is I think the concern wegordoniii and wrangler2x had (as did we).

Then if Bob shares search SearchA with read to Role1,Role2. then all four users can run it. but only Bob can maintain/modify the search itself.

If Joe makes a SearchB and marks id read for Role1 and read&write for Role2 then:
- Bob and Mary will be able to just run the search
- Joe,Gary will be able to both make changes to the search.

[gkanapathy · Accepted solution]

Yes they can, if they have "write" permissions to the app that they want to make it visible/shareable within.

[wrangler2x]

I'd like to know the answer to this last question also. What are the security implications of that?

[wegordoniii]

Excellent; thank you!

Is there documentation describing all of the consequences of giving a user write permission to the search App? I want to be aware of any security implications that this change might incur.

TIA