Security

How can non-admin users share content across apps globally?

jander476
Explorer

I want my users to be able to share content (e.g. Dashboards and field extractions) from the Search app to all other apps. These users have a limited set of capabilities, but have write permissions on the Search app and another app. However, under the "Edit Permissions" option, the "Display For": "All Apps" setting is greyed out:
alt text

The same root problem occurs with field extractions and similar configurations, where the option to select "All Apps" is not visible:
alt text

  • According to several help articles that I can't post because my karma is too low, users with write permissions on the app can "promote" an object to be "available globally to users of all apps".
  • However, in my testing, only users with the admin_all_objects capability can promote an object globally, and I cannot grant that capability to my users.
  • I granted a test user all the capabilities of the admin user except admin_all_objects, and write access to the app, and the user encountered the same limited permissions as described above.
  • I read about managing permissions through the local.meta file, but in my testing, I couldn't figure out how to grant my users the permission to share dashboards and field extractions globally through local.meta.

Does anyone have any advice or suggestions for me to try?

eavent_splunk
Splunk Employee
Splunk Employee

As commented by somesoni2, making an app or knowledge object available globally (All Apps) requires the admin_all_objects capability.

This is not very clear from the various Doc pages, so I've submitted a request to get this clarified on some pages.

0 Karma

ddrillic
Ultra Champion

Not sure if it can help but it's written well - App architecture and object ownership

0 Karma

jander476
Explorer

I did read that article, but it doesn't answer my question, unfortunately!

0 Karma

jander476
Explorer

For the curious, the links I referenced:

Users with write permissions on the app can promote an object to be available globally:

http://docs.splunk.com/Documentation/Splunk/6.3.1/Knowledge/Manageknowledgeobjectpermissions#Enablin...

https://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Apparchitectureandobjectownership (under "Make Splunk knowledge objects globally available")

Managing permissions through the local.meta file: http://docs.splunk.com/Documentation/Splunk/6.3.1/Security/Addmanagementaccesstocustomroles

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The very first line of your very first link here say "Note: This topic assumes that as a knowledge manager you have an admin role or a role with an equivalent permission set.". To be able to share an object globally, you need Admin_all_Objects capability.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...