Knowledge Management

Was the "edit_tags" capability removed?

Lowell
Super Champion

Anyone know if edi_tags was removed? I'm seeing the following warning message in the logs:

AuthorizationManager - Capability 'edit_tags' is not recognized by Splunk. Ignoring...

I still see edit_tags listed in the docs:

(I do think it's interesting that edit_tags is only shown in the examples, and is not defined in the list of capability definitions.)

Anyone know the background on this, is there a replacement for this, or is there no longer a way to prevent users from tagging things?

0 Karma

Marklar
Splunk Employee
Splunk Employee

Correct, tags are now controlled with ACLs, like many other objects in Splunk. The permissions for tags can be edited in the local.meta file for your particular app: $SPLUNK_HOME/etc/apps/appname/metadata/local.meta

For more information on setting permissions with ACLs, see http://www.splunk.com/base/Documentation/4.1.2/Developer/Step5SetPermissions

For more examples, take a look at $SPLUNK_HOME/etc/apps/search/metadata/local.meta

Lowell
Super Champion

Was this a 4.1 change? Or did it happen in 4.0 and I just missed it?

0 Karma

Lowell
Super Champion

Thanks for your answer. Yeah, I noticed that newly created tags started showing up in the .meta files, which seems to complicate things a bit. Before we pretty much had all of are tags setup to be global, but now users (or an admin) must remember to go change the permissions manually for others to leverage the tag as well. I suppose I get why this is necessary. (Another thing I've notice is that if you create a new eventtype with tags, and share the event type, you still have to go share all the tags one by one. It's a bit tedious.)

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...