Security

Add power user permissions to all private Admin Reports and Lookups

DanielFordWA
Contributor

Hi,

There are over 100 reports created by the admin and set to private.

The request is to give the power user access to all the reports. I do not want to do this manually.

All the reports are in

Splunk\etc\users\admin\search\local\savedsearches.conf

The meta data is in

\Splunk\etc\users\admin\search\metadata\local.meta

Can I just copy all the save searches to

\Splunk\etc\apps\search\local\savedsearches.conf

and add to the meta file in...

\Splunk\etc\apps\search\metadata\local.meta

....the below for each search I have copied across?

access = read : [ admin, power ], write : [ admin, power ]

Will this cause any issues for the admin user?

Is this the correct way to go about moving a large number of reports?

Can I use the same method for lookups?

Thanks,

Dan

0 Karma
1 Solution

nromito_splunk
Splunk Employee
Splunk Employee

The way you describe is exactly how you should handle moving the savedsearches.conf file if you want the owner to be "nobody"; however, if you want the searches to still be owned by admin, then you need to add owner = admin to your local.meta file stanza as well. There shouldn't be any side effects for this. You could always test this by moving a small number of savedsearches first to ensure that no dashboards or reports are breaking, and then move the rest over.

This method should work for lookups as well.

View solution in original post

nromito_splunk
Splunk Employee
Splunk Employee

The way you describe is exactly how you should handle moving the savedsearches.conf file if you want the owner to be "nobody"; however, if you want the searches to still be owned by admin, then you need to add owner = admin to your local.meta file stanza as well. There shouldn't be any side effects for this. You could always test this by moving a small number of savedsearches first to ensure that no dashboards or reports are breaking, and then move the rest over.

This method should work for lookups as well.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...