<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Event Type Permissions in Security</title>
    <link>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431708#M10147</link>
    <description>&lt;P&gt;Is there a way to easily set all event type permissions to global?  Some of my apps have many event types and none are global...&lt;/P&gt;

&lt;P&gt;Thanks.&lt;/P&gt;</description>
    <pubDate>Tue, 29 Jan 2019 18:14:23 GMT</pubDate>
    <dc:creator>sbgoldberg13</dc:creator>
    <dc:date>2019-01-29T18:14:23Z</dc:date>
    <item>
      <title>Event Type Permissions</title>
      <link>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431708#M10147</link>
      <description>&lt;P&gt;Is there a way to easily set all event type permissions to global?  Some of my apps have many event types and none are global...&lt;/P&gt;

&lt;P&gt;Thanks.&lt;/P&gt;</description>
      <pubDate>Tue, 29 Jan 2019 18:14:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431708#M10147</guid>
      <dc:creator>sbgoldberg13</dc:creator>
      <dc:date>2019-01-29T18:14:23Z</dc:date>
    </item>
    <item>
      <title>Re: Event Type Permissions</title>
      <link>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431709#M10148</link>
      <description>&lt;P&gt;From the CLI, you can go to the app where they are defined, create a &lt;CODE&gt;metadata&lt;/CODE&gt; directory and inside of that, create a &lt;CODE&gt;local.meta&lt;/CODE&gt; file with these contents:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[eventtypes]
access = read : [ * ], write : [ admin ]
export = system
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 30 Jan 2019 01:19:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431709#M10148</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2019-01-30T01:19:46Z</dc:date>
    </item>
    <item>
      <title>Re: Event Type Permissions</title>
      <link>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431710#M10149</link>
      <description>&lt;P&gt;Thanks woodcock!&lt;/P&gt;</description>
      <pubDate>Wed, 30 Jan 2019 14:31:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431710#M10149</guid>
      <dc:creator>sbgoldberg13</dc:creator>
      <dc:date>2019-01-30T14:31:28Z</dc:date>
    </item>
    <item>
      <title>Re: Event Type Permissions</title>
      <link>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431711#M10150</link>
      <description>&lt;P&gt;@woodcock &lt;/P&gt;

&lt;P&gt;Is the principal the same for macros?  Go to the app on the deployment server and do the above for [macros] ?&lt;/P&gt;</description>
      <pubDate>Thu, 07 Feb 2019 14:26:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431711#M10150</guid>
      <dc:creator>sbgoldberg13</dc:creator>
      <dc:date>2019-02-07T14:26:44Z</dc:date>
    </item>
    <item>
      <title>Re: Event Type Permissions</title>
      <link>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431712#M10151</link>
      <description>&lt;P&gt;Yes, I just answered your post regarding &lt;CODE&gt;macros&lt;/CODE&gt;.&lt;/P&gt;</description>
      <pubDate>Thu, 07 Feb 2019 15:45:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Security/Event-Type-Permissions/m-p/431712#M10151</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2019-02-07T15:45:49Z</dc:date>
    </item>
  </channel>
</rss>

