topic Re: How to set user permission for "Show Source" in Event Actions drop down? in Security

How to set user permission for "Show Source" in Event Actions drop down?

baiyungao — Tue, 03 Oct 2017 20:49:34 GMT

The splunk administrator in my organization removed some permission for my role, the consequence is that I don't have permission to run "Show Source" action. Please advise, what is the configuration Item to add "View source" feature to a role permission.

Re: How to set user permission for "Show Source" in Event Actions drop down?

sduff_splunk — Tue, 03 Oct 2017 23:27:57 GMT

You may be able to edit the dashboard by adding "/edit" to the end of the URL.
For example,
http://localhost:8000/en-GB/app/search/test_dashboard/edit

Depending on the rights, you may need to save it under a different dashboard name

Re: How to set user permission for "Show Source" in Event Actions drop down?

baiyungao — Wed, 04 Oct 2017 16:36:11 GMT

Actually I mean Event Actions - > Show Source

Re: How to set user permission for "Show Source" in Event Actions drop down?

sduff_splunk — Thu, 05 Oct 2017 01:25:45 GMT

You need to check the workflow action under Settings > Fields > Workflow actions. Either the show_source action will have been removed, disabled, or the permissions for the action has been altered.

Normally, these default actions are Global, which is Read for Everyone, Write for admin.

You need to check (with your Splunk Admin) what this has been changed to, and ensure that a role you belong to has Read access for the show_source workflow action.

Re: How to set user permission for "Show Source" in Event Actions drop down?

sduff_splunk — Thu, 05 Oct 2017 01:26:32 GMT

Apologies, you were quite clear and I was in error. I've posted another solution which should address your query.

Re: How to set user permission for "Show Source" in Event Actions drop down?

adckia — Tue, 11 Dec 2018 13:00:01 GMT

Did you solve this issue? (The answers below don't work for me. The workflow action under Settings > Fields > Workflow actions hasn't been changed, the permissions for the action are fine, including read access for the show_source workflow action.)