Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Security
- :
- How do I access collection.conf to assign write pe...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Users are able to view the data in the kvstore I created. I am unable to find the kvstore under settings > lookups, where I created it. I had added to lookup defs and added permissions. From the Settings > All Configurations >Reassign, I can see Sharing listed as app and permissions would be set as default for the App. I need to allow updates to a single group and cannot find where to do that. I see the object type is collections-conf but see nowhere to access this. Please advise.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When the kvstore is created, it is shared to the owning app with default permissions. In this case, I needed to add write permissions to a role for this specific kvstore. From Settings > All Configurations, I was able to modify the collections.conf permissions. I'm not sure if there is another way to access collections.conf, but this solved my issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When the kvstore is created, it is shared to the owning app with default permissions. In this case, I needed to add write permissions to a role for this specific kvstore. From Settings > All Configurations, I was able to modify the collections.conf permissions. I'm not sure if there is another way to access collections.conf, but this solved my issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey gibronda,
You can refer the doc below:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureKVstorelookups
collections.conf can be configured via CLI,
in $SPLUNK_HOME/etc/apps//local/ and collections.conf file has to be created.
Let me know if this helps!!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
