Making changes on the app level rather than user level

[Branden]

Whenever I (admin user) make a customization to the search app in Splunk, such as a field extraction, Splunk saves the props.conf in /splunk/etc/users/username/search/local/props.conf

I understand why it does that, but I find myself having to copy the props.conf file to /splunk/etc/apps/search/local/props.conf so that the other users can take advantage of my customizations. Then I have to bounce Splunk, etc...

Is there a way for me to make changes on-the-fly on the app level rather than on the user level?

I'm sure there's a way, and I think I read it somewhere, but I can't find it.

Thanks!

[Lowell · Accepted solution]

You can simply set the permissions on whatever entry you create from the user interface. Simply click the "Permissions" link in the "Sharing" column. Then you should be able to pick where the object should appear this app only or All apps.

Whenever you change permissions like this, the object is moved from the "user" config file to the local "app" config file.

Restarting splunk should not be necessary.

[Branden]

I knew it had to be something simple. Thanks!