Security

How can non-admin users share content across apps globally?

jander476
Explorer

I want my users to be able to share content (e.g. Dashboards and field extractions) from the Search app to all other apps. These users have a limited set of capabilities, but have write permissions on the Search app and another app. However, under the "Edit Permissions" option, the "Display For": "All Apps" setting is greyed out:
alt text

The same root problem occurs with field extractions and similar configurations, where the option to select "All Apps" is not visible:
alt text

  • According to several help articles that I can't post because my karma is too low, users with write permissions on the app can "promote" an object to be "available globally to users of all apps".
  • However, in my testing, only users with the admin_all_objects capability can promote an object globally, and I cannot grant that capability to my users.
  • I granted a test user all the capabilities of the admin user except admin_all_objects, and write access to the app, and the user encountered the same limited permissions as described above.
  • I read about managing permissions through the local.meta file, but in my testing, I couldn't figure out how to grant my users the permission to share dashboards and field extractions globally through local.meta.

Does anyone have any advice or suggestions for me to try?

eavent_splunk
Splunk Employee
Splunk Employee

As commented by somesoni2, making an app or knowledge object available globally (All Apps) requires the admin_all_objects capability.

This is not very clear from the various Doc pages, so I've submitted a request to get this clarified on some pages.

0 Karma

ddrillic
Ultra Champion

Not sure if it can help but it's written well - App architecture and object ownership

0 Karma

jander476
Explorer

I did read that article, but it doesn't answer my question, unfortunately!

0 Karma

jander476
Explorer

For the curious, the links I referenced:

Users with write permissions on the app can promote an object to be available globally:

http://docs.splunk.com/Documentation/Splunk/6.3.1/Knowledge/Manageknowledgeobjectpermissions#Enablin...

https://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Apparchitectureandobjectownership (under "Make Splunk knowledge objects globally available")

Managing permissions through the local.meta file: http://docs.splunk.com/Documentation/Splunk/6.3.1/Security/Addmanagementaccesstocustomroles

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The very first line of your very first link here say "Note: This topic assumes that as a knowledge manager you have an admin role or a role with an equivalent permission set.". To be able to share an object globally, you need Admin_all_Objects capability.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...