Is there a `umask` setting for splunk objects? (Default object permission)

Lowell — Wed, 30 Jun 2010 00:55:44 GMT

Is it possible to tell splunk what the default permissions should be when an object is created from the Splunk UI?

The best analogy I could think of is the unix "umask" tool that sets a mask for which permissions can be given to a newly created file by default. I'm wondering if there is any such concepts for objects created from within splunk.

For example, new objects are created privately by default. Which works well for many things, but it can be a serious pain when creating new tags, for example. (And even worse when tagging a newly created eventtype.) So is it possible to setup splunk to make tags application-level (or global-level) when they are created, instead of making them private by default?

I know you can setup a default.meta in your own custom app with something like this:

[tags]
access = read : [ * ], write : [ power ]
export = system

Which will make any existing tag in tags.conf (that have no explicit meta entry) readable to all, across all apps, and modifying to the "power" role, however newly created tags are just private. Can this be configured?

Re: Is there a `umask` setting for splunk objects? (Default object permission)

carasso — Tue, 04 Jan 2011 02:43:30 GMT

It's a good suggestion.

Somewhat related -- in Splunk 4.2, the Saved Search dialog allows you to specify the permissions. You can specify either:

Keep search private
Share as read-only to all users of current app

topic Is there a `umask` setting for splunk objects? (Default object permission) in Splunk Search

Is there a `umask` setting for splunk objects? (Default object permission)

Re: Is there a `umask` setting for splunk objects? (Default object permission)