We have hundreds of saved searches/reports/alerts. I need the power users role to be able to edit and maintain them, but it seems that this permission isn't set by default. Is there a way to bulk set this and have all new reports inherit Power Users / Edit?
There may be a better answer, but our solution to problems like this is to write a script (PowerShell for Windows) that iterates over all of the files called local.meta
in all of the $Splunk_Home\etc\apps\[app]\metadata
folders. You'll want to add power
to the read and write attributes. E.g.
Change:
access = read : [ admin ], write : [ admin ]
to:
access = read : [ admin, power ], write : [ admin, power ]
You'll need to restart your instance after making these changes.