Security

How to control visibility of knowledge objects spread in different apps

emafront
Explorer

Hello,
I have different knowledge object spread in different apps, for a new custom app I want to use them (lookups and eventtypes for the most part), but I don't want to give the users of the new app the possibility to see the other apps.
All knowledge objects are global but it seems that without the read permissions on the dependent apps the object is not visible.
Any clue out there?

Thank you in advance.

0 Karma

gjanders
SplunkTrust
SplunkTrust

Since you are making the app not visible to the users by not granting read permissions to it, they simply cannot see the objects inside the app even if the said object (within the app without read perms) is globally shared...I no of no solutions for this.
Older versions of ES used to use an importApps trick but I do not believe that was ever an officially supported trick...

0 Karma

@emafront besides setting the Knowledge Objects to Global, you would also need to set the read permission for Users with role to view your custom app. So you can have a different role for uses accessing your Custom App and that role should also have read access to the Knowledge Objects you need.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

emafront
Explorer

Hi @niketnilay,
I have set read permissions for the users of the cutom app to the Object of the "original" app, but if I don't assign also read permission to the original app itself (thus making it visible in the menus for the users of the custom app, which I don't want) the object is not visible.

0 Karma

memarshall63
Communicator

Re: this comment:

but if I don't assign also read permission to the original app itself (thus making it visible in the menus for the users of the custom app, which I don't want) the object is not visible.

In your secondary app, have you set the app to NOT be visible? This is a setting at the application level and from what I've seen this makes it not visible on the menus. Yes, read permission is required, but that's not what makes the app visible on the menus.

Try "Manage Apps"... go to App... "Edit Properties" set "Visible" to No.

0 Karma

emafront
Explorer

yes but I want it to be visible for the users of that app.. I guess there is no such a solution unless to use a sort of shared app (with the visible=No option) with all global objects in it.

0 Karma

gjanders
SplunkTrust
SplunkTrust

For this purpose you could create a global app with global/system level sharing.
Put the shared objects in it but make it not visible.

That way the dashboards/reports/alerts are visible in other apps but this one is not a visible app....

emafront
Explorer

yes I was doing that. It's working now.
Thank you all.

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...