Was the "edit_tags" capability removed?

[Lowell]

Anyone know if edi_tags was removed? I'm seeing the following warning message in the logs:

AuthorizationManager - Capability 'edit_tags' is not recognized by Splunk. Ignoring...

I still see edit_tags listed in the docs:

• http://www.splunk.com/base/Documentation/4.1.2/Admin/Addusersandassignroles
• http://www.splunk.com/base/Documentation/4.1.2/Admin/Authorizeconf

(I do think it's interesting that edit_tags is only shown in the examples, and is not defined in the list of capability definitions.)

Anyone know the background on this, is there a replacement for this, or is there no longer a way to prevent users from tagging things?

[Marklar]

Correct, tags are now controlled with ACLs, like many other objects in Splunk. The permissions for tags can be edited in the local.meta file for your particular app: $SPLUNK_HOME/etc/apps/appname/metadata/local.meta

For more information on setting permissions with ACLs, see http://www.splunk.com/base/Documentation/4.1.2/Developer/Step5SetPermissions

For more examples, take a look at $SPLUNK_HOME/etc/apps/search/metadata/local.meta

[Lowell]

Was this a 4.1 change? Or did it happen in 4.0 and I just missed it?

[Lowell]

Thanks for your answer. Yeah, I noticed that newly created tags started showing up in the .meta files, which seems to complicate things a bit. Before we pretty much had all of are tags setup to be global, but now users (or an admin) must remember to go change the permissions manually for others to leverage the tag as well. I suppose I get why this is necessary. (Another thing I've notice is that if you create a new eventtype with tags, and share the event type, you still have to go share all the tags one by one. It's a bit tedious.)