How to save a search in an app instead of user setting

[zscgeek]

When saving a search in the UI (on splunk 4.1.2) via the action menu the search is always saved in the user context (etc/users/$username/search/local/savedsearches.conf).

How can I force it to be shared between users into one of the apps (eg etc/apps/search/local/savedsearches.conf)?

I tried going into the manager page after the fact to change the ownership settings but it's not listed there. The only way I was able to move it into a shared context was to edit the conf files by hand.

[zscgeek · Accepted solution]

Turns out the problem is that if you are using scripted auth and don't return a complete list of users that have logged into the UI in the listUsers() function saved searches are not visible in the UI. The fix was to go in and update the script to list users who have logged in using this script:

def getUsers( args ):
   out = "--status=success"
   path="/opt/splunk/etc/users/"
   dirList=os.listdir(path)
   for u in dirList:
     if (u!="users.ini"):
       out += ' --userInfo=' + u + ';' + u + ';' + u + ';' + ':admin'
   print out

[Genti]

By going to Permissions and choosing the ALL APPS option you can set the permission to the specific app only or globally...
Furthermore, you should allow everyone to READ and the owner only to Write.

Otherwise just cut and paste the .conf file as you already have done..

Hope this helps,
.gz