What Splunk capability allows global read access for all (even private) SIDs (search jobs)?

[woodcock]

There is a bug in the Job "Share" button: It only works for admins!

Analysts have mentioned that within the search head, they are unable to share jobs with one other. This means that while anyone is investigating alerts, reviewing things, etc., he must share the actual search SPL query and whomever he is working with has to re-run that search again.

I know that the default "admin" role allows any user to view the private jobs of others but of course we don't want to give the "admin" role to all of the analysts. I reviewed all of the Splunk "capabilities" and could not find one that would be related to this permission.

I am going to open a case, but I am looking for a quicker work-around solution.

[woodcock]

Support has acknowledged the bug:
This investigation is under this number (SPL-231347) and explains:
Splunk Admins can now control how searches are shared using the flag "enable_share_job_control" in the "web_features.conf" file. They can enable the users to share the search query instead of sharing the search as a job.
The Admin user can change the permissions for a search job to share that job with other users. Could share a job by exporting job results to a file.

Also Splunk documentation about it:
https://docs.splunk.com/Documentation/Splunk/9.0.2/Search/SavingandsharingjobsinSplunkWeb