Deployment Architecture

How do you set app permissions in a search head cluster?

rmorlen
Splunk Employee
Splunk Employee

How do you set app permissions in a search head cluster? I don't see any permissions options in Manage Apps.

0 Karma
1 Solution

dolivasoh
Contributor

You should first do this on another instance and port your app into your deployer. I personally edit live on the deployer instance and rsync the app over to the deployment apps directory after making a significant change.

Be sure to also maintain the same roles on the search head cluster so everything fits into place. You can deploy authentication.conf and authorize.conf via shcluster app.

View solution in original post

dolivasoh
Contributor

You should first do this on another instance and port your app into your deployer. I personally edit live on the deployer instance and rsync the app over to the deployment apps directory after making a significant change.

Be sure to also maintain the same roles on the search head cluster so everything fits into place. You can deploy authentication.conf and authorize.conf via shcluster app.

splunkreal
Motivator

I've the same problem, is there a clear way to set search app permissions on all search head nodes?

I had to connect on a search head to update search app permissions in manage apps

I've also seen that local.meta has then been updated

Also what are the differences between default.meta and local.meta?

Many thanks!

* If this helps, please upvote or accept solution 🙂 *
0 Karma

rmorlen
Splunk Employee
Splunk Employee

I was kind of hoping to avoid that option but looks like I won't have a choice.

Are the settings part of local.meta?

Currently authentication, authorize, and other .confs are deployed to SHC members via an app.

Thanks,

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...