Reporting

How to save a search in an app instead of user setting

zscgeek
Path Finder

When saving a search in the UI (on splunk 4.1.2) via the action menu the search is always saved in the user context (etc/users/$username/search/local/savedsearches.conf).

How can I force it to be shared between users into one of the apps (eg etc/apps/search/local/savedsearches.conf)?

I tried going into the manager page after the fact to change the ownership settings but it's not listed there. The only way I was able to move it into a shared context was to edit the conf files by hand.

Tags (2)
1 Solution

zscgeek
Path Finder

Turns out the problem is that if you are using scripted auth and don't return a complete list of users that have logged into the UI in the listUsers() function saved searches are not visible in the UI. The fix was to go in and update the script to list users who have logged in using this script:

def getUsers( args ):
   out = "--status=success"
   path="/opt/splunk/etc/users/"
   dirList=os.listdir(path)
   for u in dirList:
     if (u!="users.ini"):
       out += ' --userInfo=' + u + ';' + u + ';' + u + ';' + ':admin'
   print out

View solution in original post

zscgeek
Path Finder

Turns out the problem is that if you are using scripted auth and don't return a complete list of users that have logged into the UI in the listUsers() function saved searches are not visible in the UI. The fix was to go in and update the script to list users who have logged in using this script:

def getUsers( args ):
   out = "--status=success"
   path="/opt/splunk/etc/users/"
   dirList=os.listdir(path)
   for u in dirList:
     if (u!="users.ini"):
       out += ' --userInfo=' + u + ';' + u + ';' + u + ';' + ':admin'
   print out

Genti
Splunk Employee
Splunk Employee

By going to Permissions and choosing the ALL APPS option you can set the permission to the specific app only or globally...
Furthermore, you should allow everyone to READ and the owner only to Write.

Otherwise just cut and paste the .conf file as you already have done..

Hope this helps,
.gz

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...