Security

Add power user permissions to all private Admin Reports and Lookups

DanielFordWA
Contributor

Hi,

There are over 100 reports created by the admin and set to private.

The request is to give the power user access to all the reports. I do not want to do this manually.

All the reports are in

Splunk\etc\users\admin\search\local\savedsearches.conf

The meta data is in

\Splunk\etc\users\admin\search\metadata\local.meta

Can I just copy all the save searches to

\Splunk\etc\apps\search\local\savedsearches.conf

and add to the meta file in...

\Splunk\etc\apps\search\metadata\local.meta

....the below for each search I have copied across?

access = read : [ admin, power ], write : [ admin, power ]

Will this cause any issues for the admin user?

Is this the correct way to go about moving a large number of reports?

Can I use the same method for lookups?

Thanks,

Dan

0 Karma
1 Solution

nromito_splunk
Splunk Employee
Splunk Employee

The way you describe is exactly how you should handle moving the savedsearches.conf file if you want the owner to be "nobody"; however, if you want the searches to still be owned by admin, then you need to add owner = admin to your local.meta file stanza as well. There shouldn't be any side effects for this. You could always test this by moving a small number of savedsearches first to ensure that no dashboards or reports are breaking, and then move the rest over.

This method should work for lookups as well.

View solution in original post

nromito_splunk
Splunk Employee
Splunk Employee

The way you describe is exactly how you should handle moving the savedsearches.conf file if you want the owner to be "nobody"; however, if you want the searches to still be owned by admin, then you need to add owner = admin to your local.meta file stanza as well. There shouldn't be any side effects for this. You could always test this by moving a small number of savedsearches first to ensure that no dashboards or reports are breaking, and then move the rest over.

This method should work for lookups as well.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!