How do I access collection.conf to assign write permissions for kvstore?

[gibronda]

Users are able to view the data in the kvstore I created. I am unable to find the kvstore under settings > lookups, where I created it. I had added to lookup defs and added permissions. From the Settings > All Configurations >Reassign, I can see Sharing listed as app and permissions would be set as default for the App. I need to allow updates to a single group and cannot find where to do that. I see the object type is collections-conf but see nowhere to access this. Please advise.

[gibronda · Accepted solution]

When the kvstore is created, it is shared to the owning app with default permissions. In this case, I needed to add write permissions to a role for this specific kvstore. From Settings > All Configurations, I was able to modify the collections.conf permissions. I'm not sure if there is another way to access collections.conf, but this solved my issue.

[deepashri_123]

Hey gibronda,

You can refer the doc below:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureKVstorelookups

collections.conf can be configured via CLI,
in $SPLUNK_HOME/etc/apps//local/ and collections.conf file has to be created.

Let me know if this helps!!