Knowledge Management

Sharing global in config

sloshburch
Splunk Employee
Splunk Employee

This should be an easy one:

From a config file perspective, how do I define an app's knowledge object (a savedsearch for example) as being shared globally?

Thus far, I have been unable to find them in the local.meta and viewstates.conf

1 Solution

somesoni2
Revered Legend

In local.meta file, for each knowledge objects, there is a property called "export" which defines the sharing permission for the object.

export = none - Sharing permission is "This App"/"private"
export = system - sharing permission is "All Apps" or Global

So, export = system is what you're looking for.

View solution in original post

somesoni2
Revered Legend

In local.meta file, for each knowledge objects, there is a property called "export" which defines the sharing permission for the object.

export = none - Sharing permission is "This App"/"private"
export = system - sharing permission is "All Apps" or Global

So, export = system is what you're looking for.

somesoni2
Revered Legend

Great... if this solved your problem, please close the question by accepting the answer.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I see it now. I don't know why when I was searching the export field I didn't see it - thanks!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...