Security

How to control visibility of knowledge objects spread in different apps

emafront
Explorer

Hello,
I have different knowledge object spread in different apps, for a new custom app I want to use them (lookups and eventtypes for the most part), but I don't want to give the users of the new app the possibility to see the other apps.
All knowledge objects are global but it seems that without the read permissions on the dependent apps the object is not visible.
Any clue out there?

Thank you in advance.

0 Karma

gjanders
SplunkTrust
SplunkTrust

Since you are making the app not visible to the users by not granting read permissions to it, they simply cannot see the objects inside the app even if the said object (within the app without read perms) is globally shared...I no of no solutions for this.
Older versions of ES used to use an importApps trick but I do not believe that was ever an officially supported trick...

0 Karma

niketn
Legend

@emafront besides setting the Knowledge Objects to Global, you would also need to set the read permission for Users with role to view your custom app. So you can have a different role for uses accessing your Custom App and that role should also have read access to the Knowledge Objects you need.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

emafront
Explorer

Hi @niketnilay,
I have set read permissions for the users of the cutom app to the Object of the "original" app, but if I don't assign also read permission to the original app itself (thus making it visible in the menus for the users of the custom app, which I don't want) the object is not visible.

0 Karma

memarshall63
Communicator

Re: this comment:

but if I don't assign also read permission to the original app itself (thus making it visible in the menus for the users of the custom app, which I don't want) the object is not visible.

In your secondary app, have you set the app to NOT be visible? This is a setting at the application level and from what I've seen this makes it not visible on the menus. Yes, read permission is required, but that's not what makes the app visible on the menus.

Try "Manage Apps"... go to App... "Edit Properties" set "Visible" to No.

0 Karma

emafront
Explorer

yes but I want it to be visible for the users of that app.. I guess there is no such a solution unless to use a sort of shared app (with the visible=No option) with all global objects in it.

0 Karma

gjanders
SplunkTrust
SplunkTrust

For this purpose you could create a global app with global/system level sharing.
Put the shared objects in it but make it not visible.

That way the dashboards/reports/alerts are visible in other apps but this one is not a visible app....

emafront
Explorer

yes I was doing that. It's working now.
Thank you all.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...