Security

Change file permissions?

splunkuseradmin
Path Finder

hi everyone,
I have uploaded a lookup file (file1.csv).
Under sharing its permissions are set to private. How do I change it to globally from UI?

When I go to settings > lookups> lookups and tables> permissions>",
and I change from keep APP to This app only (everyone read).

I get this error:

"Splunk could not update permissions for resource data/lookup-table-files [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/231234/cisco_cdr/data/lookup-table-files/file1.csv/acl";

Please help me change permissions globally.

Thanks

0 Karma
1 Solution

bpadmanbhachari
Splunk Employee
Splunk Employee

The power user cannot share the lookup file globally, but you can request admin role user to make it global.

settings > lookups> lookup table files > permissions > Change from "This app only" to "All apps". Then it will be global

View solution in original post

0 Karma

bpadmanbhachari
Splunk Employee
Splunk Employee

The power user cannot share the lookup file globally, but you can request admin role user to make it global.

settings > lookups> lookup table files > permissions > Change from "This app only" to "All apps". Then it will be global

0 Karma

evania
Splunk Employee
Splunk Employee

Hi @splunkuseradmin ,

Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

0 Karma

splunkuseradmin
Path Finder

for my admin as well there is only 2 options in permissions
1. private
2 ."this app only"

or you saying, ask him to upload my lookups from his side and change permissions to "All Apps" ?

or can he change permissions of my "private lookups" which i want to make it "globally" ?

0 Karma

bpadmanbhachari
Splunk Employee
Splunk Employee

This is how I tried in my environment.

Created power user, logged in with that user.
Created lookup tables and provided read to all and write permission to admin.
Logged in as admin user now, >> lookup tables >> under permission >> I can find "All apps" tab as well.
You cam try same steps.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...