topic Re: Making changes on the app level rather than user level in Security

Making changes on the app level rather than user level

Branden — Tue, 05 Oct 2010 21:07:41 GMT

Whenever I (admin user) make a customization to the search app in Splunk, such as a field extraction, Splunk saves the props.conf in /splunk/etc/users/username/search/local/props.conf

I understand why it does that, but I find myself having to copy the props.conf file to /splunk/etc/apps/search/local/props.conf so that the other users can take advantage of my customizations. Then I have to bounce Splunk, etc...

Is there a way for me to make changes on-the-fly on the app level rather than on the user level?

I'm sure there's a way, and I think I read it somewhere, but I can't find it.

Thanks!

Re: Making changes on the app level rather than user level

Lowell — Tue, 05 Oct 2010 22:07:50 GMT

You can simply set the permissions on whatever entry you create from the user interface. Simply click the "Permissions" link in the "Sharing" column. Then you should be able to pick where the object should appear this app only or All apps.

Whenever you change permissions like this, the object is moved from the "user" config file to the local "app" config file.

Restarting splunk should not be necessary.

Re: Making changes on the app level rather than user level

Branden — Tue, 05 Oct 2010 22:13:47 GMT

I knew it had to be something simple. Thanks!