Security

Create a read only lookup table

FritzWittwer
Path Finder

I have a user which needs to be able to write one specific lookup table which has to be shared globally. I have to control with the permission settings on the lookup  as I have several users/roles where each role has to grant write access to a different lookup table.

What i have observed so far:
in order to be able to write a lookup table with | outputlookup xxxx.csv, the user needs the capability output_file. This capability is be default granted trough the predefined user role.

With the capability output_file, the permission configured in local.meta is ignored,  outputlookup writes happily any lookup file, regardless of the permission, even files which don't exist.

 

What i am missing here?

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...