Security

Changing permissions for multiple eventtypes

hmallett
Path Finder

I have been using Splunk for a few months, and now have a number of eventtypes defined. However, they've all got private permissions (the default), and we've now discovered that they should be shared within the search app for our needs.

I know I can change the permissions on each eventtype individually, but is there a quicker way to change the permissions for multiple objects?

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

Permissions are set on a per object basis, so they do need to be changed individually. There isn't a global permissions feature that would allow you to change a particular subset of permissions in an automated fashion. You may be able to script something to look at the local.meta file in the metadata folder of the app/user directory where the object exists, but you'd obviously need to do that outside of the product itself.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

Permissions are set on a per object basis, so they do need to be changed individually. There isn't a global permissions feature that would allow you to change a particular subset of permissions in an automated fashion. You may be able to script something to look at the local.meta file in the metadata folder of the app/user directory where the object exists, but you'd obviously need to do that outside of the product itself.

sansay
Contributor

I do not find this answer acceptable. It is a royal pain to have to click twice on every single knowledge object to change the same setting. Due to our users creating dangerous dashboards for splunk performance, we are forced to control the privileges for every single knowledge object they create. As a result I spend so much time just changing permissions on sometimes more than 50 objects. It's ridiculous. And this is only talking about permissions. What about enabling, disabling, moving, deleting?
One should be able select them and apply the same setting to all selected KO with just one click. This is what I call "intuitive GUI design".
Furthermore, I am writing this today October 4th, 2017, and this was asked in 2012, so 5 years later and still nothing done to improve this. I saw at the conference in 2016 someone demonstrating what I just described, but for some mysterious reason, it never made it in the last version. I would love to know why.

chadmedeiros
Path Finder

Hello! Checking in August 22, 2024 -- still not able to edit permissions on multiple objects at once. 

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...