Security

How to control visibility of knowledge objects spread in different apps

emafront
Explorer

Hello,
I have different knowledge object spread in different apps, for a new custom app I want to use them (lookups and eventtypes for the most part), but I don't want to give the users of the new app the possibility to see the other apps.
All knowledge objects are global but it seems that without the read permissions on the dependent apps the object is not visible.
Any clue out there?

Thank you in advance.

0 Karma

gjanders
SplunkTrust
SplunkTrust

Since you are making the app not visible to the users by not granting read permissions to it, they simply cannot see the objects inside the app even if the said object (within the app without read perms) is globally shared...I no of no solutions for this.
Older versions of ES used to use an importApps trick but I do not believe that was ever an officially supported trick...

0 Karma

@emafront besides setting the Knowledge Objects to Global, you would also need to set the read permission for Users with role to view your custom app. So you can have a different role for uses accessing your Custom App and that role should also have read access to the Knowledge Objects you need.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

emafront
Explorer

Hi @niketnilay,
I have set read permissions for the users of the cutom app to the Object of the "original" app, but if I don't assign also read permission to the original app itself (thus making it visible in the menus for the users of the custom app, which I don't want) the object is not visible.

0 Karma

memarshall63
Communicator

Re: this comment:

but if I don't assign also read permission to the original app itself (thus making it visible in the menus for the users of the custom app, which I don't want) the object is not visible.

In your secondary app, have you set the app to NOT be visible? This is a setting at the application level and from what I've seen this makes it not visible on the menus. Yes, read permission is required, but that's not what makes the app visible on the menus.

Try "Manage Apps"... go to App... "Edit Properties" set "Visible" to No.

0 Karma

emafront
Explorer

yes but I want it to be visible for the users of that app.. I guess there is no such a solution unless to use a sort of shared app (with the visible=No option) with all global objects in it.

0 Karma

gjanders
SplunkTrust
SplunkTrust

For this purpose you could create a global app with global/system level sharing.
Put the shared objects in it but make it not visible.

That way the dashboards/reports/alerts are visible in other apps but this one is not a visible app....

emafront
Explorer

yes I was doing that. It's working now.
Thank you all.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...