Knowledge Management

Help with knowledge objects permissions?

daniel333
Builder

All,

Alright, don't really have my head around knowledge objects permissions. I have roughly 100 field extractions that I am globally exporting. I'd rather restrict the to a single app called "Company App" (note the space).

Here is what I tried in my default.meta

[]
export = Company App

But didn't seem to work. Guessing there is a trick to this I am missing.

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

Where is the metadata file you are modifying for this? If the field extraction are contained within the app already but exported globally it would work to do:

[]
export = none

This set the default for export within the app to be within the app context. One thing you will have to look for is if there are stanzas for each field in local.meta. In order to switch them to shared within the app you will either have to change export = none for each stanza, delete the stanza so it reverts to the default (careful if there are other local changes to the stanza), or remove local.meta so everything falls under default.meta (all local permissions changes would revert to those defined in default.meta).

Think of it this way in the folder structure:
Private Permissons - /opt/splunk/etc/user/user_name/app_name/metadata

App Permissions - /opt/splunk/etc/app_name/metadata

export = none

Global Permissions - /opt/splunk/etc/app_name/metadata
export = system

Hope this helps. Let me know if you need further clarification.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...