Users are able to view the data in the kvstore I created. I am unable to find the kvstore under settings > lookups, where I created it. I had added to lookup defs and added permissions. From the Settings > All Configurations >Reassign, I can see Sharing listed as app and permissions would be set as default for the App. I need to allow updates to a single group and cannot find where to do that. I see the object type is collections-conf but see nowhere to access this. Please advise.
When the kvstore is created, it is shared to the owning app with default permissions. In this case, I needed to add write permissions to a role for this specific kvstore. From Settings > All Configurations, I was able to modify the collections.conf permissions. I'm not sure if there is another way to access collections.conf, but this solved my issue.
When the kvstore is created, it is shared to the owning app with default permissions. In this case, I needed to add write permissions to a role for this specific kvstore. From Settings > All Configurations, I was able to modify the collections.conf permissions. I'm not sure if there is another way to access collections.conf, but this solved my issue.
Hey gibronda,
You can refer the doc below:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureKVstorelookups
collections.conf can be configured via CLI,
in $SPLUNK_HOME/etc/apps//local/ and collections.conf file has to be created.
Let me know if this helps!!