topic Is there a way to use default.meta to lock down write access to field extractions? in Splunk Search

Is there a way to use default.meta to lock down write access to field extractions?

the_wolverine — Tue, 23 May 2017 23:40:42 GMT

We are considering locking down access to share field extractions. Is anyone aware of a way to do this easily? We want users to share other KOs so we don't want to completely remove write access to the search app.

Re: Is there a way to use default.meta to lock down write access to field extractions?

ben_leung — Wed, 24 May 2017 05:45:33 GMT

You need something like this in your local.meta in the search app:

[props]
access = read : [ admin ], write : [ admin ]
export = none

Locking it down to admin only and then from there allow which ever roles.
Also make sure the roles have capability to write in the search app first or this won't work.

Re: Is there a way to use default.meta to lock down write access to field extractions?

the_wolverine — Wed, 31 May 2017 17:19:59 GMT

Thanks 🙂 It worked. To be clear this doesn't prevent the field extraction from being created. Users can still create their own private extractions, they just will not be able to share them.

[props]
export = system
access = read : [ * ], write : [ admin ]

[transforms]
export = system
access = read : [ * ], write : [ admin ]