Reporting

How to save a search in an app instead of user setting

zscgeek
Path Finder

When saving a search in the UI (on splunk 4.1.2) via the action menu the search is always saved in the user context (etc/users/$username/search/local/savedsearches.conf).

How can I force it to be shared between users into one of the apps (eg etc/apps/search/local/savedsearches.conf)?

I tried going into the manager page after the fact to change the ownership settings but it's not listed there. The only way I was able to move it into a shared context was to edit the conf files by hand.

Tags (2)
1 Solution

zscgeek
Path Finder

Turns out the problem is that if you are using scripted auth and don't return a complete list of users that have logged into the UI in the listUsers() function saved searches are not visible in the UI. The fix was to go in and update the script to list users who have logged in using this script:

def getUsers( args ):
   out = "--status=success"
   path="/opt/splunk/etc/users/"
   dirList=os.listdir(path)
   for u in dirList:
     if (u!="users.ini"):
       out += ' --userInfo=' + u + ';' + u + ';' + u + ';' + ':admin'
   print out

View solution in original post

zscgeek
Path Finder

Turns out the problem is that if you are using scripted auth and don't return a complete list of users that have logged into the UI in the listUsers() function saved searches are not visible in the UI. The fix was to go in and update the script to list users who have logged in using this script:

def getUsers( args ):
   out = "--status=success"
   path="/opt/splunk/etc/users/"
   dirList=os.listdir(path)
   for u in dirList:
     if (u!="users.ini"):
       out += ' --userInfo=' + u + ';' + u + ';' + u + ';' + ':admin'
   print out

Genti
Splunk Employee
Splunk Employee

By going to Permissions and choosing the ALL APPS option you can set the permission to the specific app only or globally...
Furthermore, you should allow everyone to READ and the owner only to Write.

Otherwise just cut and paste the .conf file as you already have done..

Hope this helps,
.gz

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...