Security

How can non-admin users share content across apps globally?

jander476
Explorer

I want my users to be able to share content (e.g. Dashboards and field extractions) from the Search app to all other apps. These users have a limited set of capabilities, but have write permissions on the Search app and another app. However, under the "Edit Permissions" option, the "Display For": "All Apps" setting is greyed out:
alt text

The same root problem occurs with field extractions and similar configurations, where the option to select "All Apps" is not visible:
alt text

  • According to several help articles that I can't post because my karma is too low, users with write permissions on the app can "promote" an object to be "available globally to users of all apps".
  • However, in my testing, only users with the admin_all_objects capability can promote an object globally, and I cannot grant that capability to my users.
  • I granted a test user all the capabilities of the admin user except admin_all_objects, and write access to the app, and the user encountered the same limited permissions as described above.
  • I read about managing permissions through the local.meta file, but in my testing, I couldn't figure out how to grant my users the permission to share dashboards and field extractions globally through local.meta.

Does anyone have any advice or suggestions for me to try?

eavent_splunk
Splunk Employee
Splunk Employee

As commented by somesoni2, making an app or knowledge object available globally (All Apps) requires the admin_all_objects capability.

This is not very clear from the various Doc pages, so I've submitted a request to get this clarified on some pages.

0 Karma

ddrillic
Ultra Champion

Not sure if it can help but it's written well - App architecture and object ownership

0 Karma

jander476
Explorer

I did read that article, but it doesn't answer my question, unfortunately!

0 Karma

jander476
Explorer

For the curious, the links I referenced:

Users with write permissions on the app can promote an object to be available globally:

http://docs.splunk.com/Documentation/Splunk/6.3.1/Knowledge/Manageknowledgeobjectpermissions#Enablin...

https://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Apparchitectureandobjectownership (under "Make Splunk knowledge objects globally available")

Managing permissions through the local.meta file: http://docs.splunk.com/Documentation/Splunk/6.3.1/Security/Addmanagementaccesstocustomroles

0 Karma

somesoni2
Revered Legend

The very first line of your very first link here say "Note: This topic assumes that as a knowledge manager you have an admin role or a role with an equivalent permission set.". To be able to share an object globally, you need Admin_all_Objects capability.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...