Add power user permissions to all private Admin Reports and Lookups

[DanielFordWA]

Hi,

There are over 100 reports created by the admin and set to private.

The request is to give the power user access to all the reports. I do not want to do this manually.

All the reports are in

Splunk\etc\users\admin\search\local\savedsearches.conf

The meta data is in

\Splunk\etc\users\admin\search\metadata\local.meta

Can I just copy all the save searches to

\Splunk\etc\apps\search\local\savedsearches.conf

and add to the meta file in...

\Splunk\etc\apps\search\metadata\local.meta

....the below for each search I have copied across?

access = read : [ admin, power ], write : [ admin, power ]

Will this cause any issues for the admin user?

Is this the correct way to go about moving a large number of reports?

Can I use the same method for lookups?

Thanks,

Dan

[nromito_splunk · Accepted solution]

The way you describe is exactly how you should handle moving the savedsearches.conf file if you want the owner to be "nobody"; however, if you want the searches to still be owned by admin, then you need to add owner = admin to your local.meta file stanza as well. There shouldn't be any side effects for this. You could always test this by moving a small number of savedsearches first to ensure that no dashboards or reports are breaking, and then move the rest over.

This method should work for lookups as well.