Help with knowledge objects permissions?

[daniel333]

All,

Alright, don't really have my head around knowledge objects permissions. I have roughly 100 field extractions that I am globally exporting. I'd rather restrict the to a single app called "Company App" (note the space).

Here is what I tried in my default.meta

[]
export = Company App

But didn't seem to work. Guessing there is a trick to this I am missing.

[mdsnmss]

Where is the metadata file you are modifying for this? If the field extraction are contained within the app already but exported globally it would work to do:

[]
export = none

This set the default for export within the app to be within the app context. One thing you will have to look for is if there are stanzas for each field in local.meta. In order to switch them to shared within the app you will either have to change export = none for each stanza, delete the stanza so it reverts to the default (careful if there are other local changes to the stanza), or remove local.meta so everything falls under default.meta (all local permissions changes would revert to those defined in default.meta).

Think of it this way in the folder structure:
Private Permissons - /opt/splunk/etc/user/user_name/app_name/metadata

App Permissions - /opt/splunk/etc/app_name/metadata

export = none

Global Permissions - /opt/splunk/etc/app_name/metadata
export = system

Hope this helps. Let me know if you need further clarification.