- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Can't set report transform as global to all apps
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can't set report transform as global to all apps
I have a set of report transforms in an application that I am trying to make global so that fields are extracted when inside the context of the application which defines them and any other application. Via the GUI selecting the "All apps" radio button appears to save correctly but going back into the permissions page shows the transform is still permissioned for "This app only". Any ideas what is going on here and/or another way I can set up transforms that will work across all apps?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm running into the same thing with "Global" inline fields. Anyone?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I figured out what was causing my issue. While I would create the extraction in an application and set it to all applications & give read only to everyone; the user also needs to have at least read only access to the application that the extraction is in.
So I usually create all global objects in the Search application because Splunk 4.1.6 beta has a lot of references to this application so I've had nothing but issues with disabling this app anyway. Then I give all roles at least read only access to the search application.
Another option is to add these to the system app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
While I am not sure if this is the correct way to accomplish this, or the most efficent, I found adding the following into metatdata/local.meta seems to do what I want.
[lookups]
export = system
[tags]
export = system
[props]
export = system
[transforms]
export = system
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can create the settings on the CLI and it will, by default, make the permission Global for that setting/setup. To change the permission on the GUI, you will either have to login as Admin or as the owner of the transform config.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Even configuring the transform and REPORT entry via the command line the fields are still only available in the app they are defined within. I am not sure what else to try at this point. I am unable make the extraction global for all applications which means users don't have access to the fields from the default search app as well as the app in which the fields are defined. Any other ideas?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To eliminate duplication, make sure you remove your current transform config on the GUI before you proceed with the CLI.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've tried to change the permissions via the GUI as admin and I observed the same behavior. I will try via the config next.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
