Creating a role that can read every app

[Ricapar]

I'm setting up my roles like this:

== Global Roles ==

• Admin Role
• Manager Role
• Users

== App Specific Roles ==

• AppName_R
• AppName_RW
• AppName2_R
• AppName2_RW

... etc ... You get the idea.

I have everything nicely set up for the Admin role and for the app specific roles. All of the app roles inherit from the "users" role and inherit basic permissions from there.

Admin Role is the default admin role that comes with Splunk.

Each app is configured with only three checkboxes checked on the permissions page:

Role           Read   Write
AppName_R        X  
AppName_RW       X      X

Like so.

This works great, since it makes setting permissions for new apps nice and easy, and is obvious to users who can do what.

Admins can automatically read and write to everything, even if permissions aren't explicitly given.

What I'm trying to create for the Manager Role is a user who can automatically read from everything (just like admins), but doesn't have any explicit write permissions.

[Ricapar · Accepted solution]

I ended up solving this using @yannK's and @chris's suggestion.

I created a role that we will manually set to inherit from every AppName_R role. We added the extra step to our (currently manual) application role setup procedure. I would've preferred something a bit more automated, but one extra step isn't a dealbreaker.

[chris]

You could setup, a Manager Role that inherits from every AppName_R role. aholzer's suggestion works as well but you can loop through the metadata/default.meta on the filesystem and add the additional role to the read stanza.

[yannK]

What about role inheritance ?

[Ricapar]

That's what I was hoping to avoid 😞

[aholzer]

Unfortunately I don't think this is possible from the ROLE's perspective. You would have to create a new role, then manually go through the permissions of each app and grant "read only" permissions to the new role (you can do this from the "Manager > apps" Interface)