Security

How can non-admin users share content across apps globally?

jander476
Explorer

I want my users to be able to share content (e.g. Dashboards and field extractions) from the Search app to all other apps. These users have a limited set of capabilities, but have write permissions on the Search app and another app. However, under the "Edit Permissions" option, the "Display For": "All Apps" setting is greyed out:
alt text

The same root problem occurs with field extractions and similar configurations, where the option to select "All Apps" is not visible:
alt text

  • According to several help articles that I can't post because my karma is too low, users with write permissions on the app can "promote" an object to be "available globally to users of all apps".
  • However, in my testing, only users with the admin_all_objects capability can promote an object globally, and I cannot grant that capability to my users.
  • I granted a test user all the capabilities of the admin user except admin_all_objects, and write access to the app, and the user encountered the same limited permissions as described above.
  • I read about managing permissions through the local.meta file, but in my testing, I couldn't figure out how to grant my users the permission to share dashboards and field extractions globally through local.meta.

Does anyone have any advice or suggestions for me to try?

eavent_splunk
Splunk Employee
Splunk Employee

As commented by somesoni2, making an app or knowledge object available globally (All Apps) requires the admin_all_objects capability.

This is not very clear from the various Doc pages, so I've submitted a request to get this clarified on some pages.

0 Karma

ddrillic
Ultra Champion

Not sure if it can help but it's written well - App architecture and object ownership

0 Karma

jander476
Explorer

I did read that article, but it doesn't answer my question, unfortunately!

0 Karma

jander476
Explorer

For the curious, the links I referenced:

Users with write permissions on the app can promote an object to be available globally:

http://docs.splunk.com/Documentation/Splunk/6.3.1/Knowledge/Manageknowledgeobjectpermissions#Enablin...

https://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Apparchitectureandobjectownership (under "Make Splunk knowledge objects globally available")

Managing permissions through the local.meta file: http://docs.splunk.com/Documentation/Splunk/6.3.1/Security/Addmanagementaccesstocustomroles

0 Karma

somesoni2
Revered Legend

The very first line of your very first link here say "Note: This topic assumes that as a knowledge manager you have an admin role or a role with an equivalent permission set.". To be able to share an object globally, you need Admin_all_Objects capability.

0 Karma
Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...