Knowledge Management

Help with knowledge objects permissions?

daniel333
Builder

All,

Alright, don't really have my head around knowledge objects permissions. I have roughly 100 field extractions that I am globally exporting. I'd rather restrict the to a single app called "Company App" (note the space).

Here is what I tried in my default.meta

[]
export = Company App

But didn't seem to work. Guessing there is a trick to this I am missing.

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

Where is the metadata file you are modifying for this? If the field extraction are contained within the app already but exported globally it would work to do:

[]
export = none

This set the default for export within the app to be within the app context. One thing you will have to look for is if there are stanzas for each field in local.meta. In order to switch them to shared within the app you will either have to change export = none for each stanza, delete the stanza so it reverts to the default (careful if there are other local changes to the stanza), or remove local.meta so everything falls under default.meta (all local permissions changes would revert to those defined in default.meta).

Think of it this way in the folder structure:
Private Permissons - /opt/splunk/etc/user/user_name/app_name/metadata

App Permissions - /opt/splunk/etc/app_name/metadata

export = none

Global Permissions - /opt/splunk/etc/app_name/metadata
export = system

Hope this helps. Let me know if you need further clarification.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...