Knowledge Management

Was the "edit_tags" capability removed?

Lowell
Super Champion

Anyone know if edi_tags was removed? I'm seeing the following warning message in the logs:

AuthorizationManager - Capability 'edit_tags' is not recognized by Splunk. Ignoring...

I still see edit_tags listed in the docs:

(I do think it's interesting that edit_tags is only shown in the examples, and is not defined in the list of capability definitions.)

Anyone know the background on this, is there a replacement for this, or is there no longer a way to prevent users from tagging things?

0 Karma

Marklar
Splunk Employee
Splunk Employee

Correct, tags are now controlled with ACLs, like many other objects in Splunk. The permissions for tags can be edited in the local.meta file for your particular app: $SPLUNK_HOME/etc/apps/appname/metadata/local.meta

For more information on setting permissions with ACLs, see http://www.splunk.com/base/Documentation/4.1.2/Developer/Step5SetPermissions

For more examples, take a look at $SPLUNK_HOME/etc/apps/search/metadata/local.meta

Lowell
Super Champion

Was this a 4.1 change? Or did it happen in 4.0 and I just missed it?

0 Karma

Lowell
Super Champion

Thanks for your answer. Yeah, I noticed that newly created tags started showing up in the .meta files, which seems to complicate things a bit. Before we pretty much had all of are tags setup to be global, but now users (or an admin) must remember to go change the permissions manually for others to leverage the tag as well. I suppose I get why this is necessary. (Another thing I've notice is that if you create a new eventtype with tags, and share the event type, you still have to go share all the tags one by one. It's a bit tedious.)

0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...