Security

Problem with a user's ability to set permissions on a saved search

wrangler2x
Motivator

I have created a role for a group of users for whom we are collecting their Windows Exchange logs and Windows events logs. This role inherits from 'user'. Things have been fine, but one user wanted to share a saved search with other members of his group (user_wsg). The search is shows in the manager (Searches and Reports) as part of the Search App, and it under sharing it is the default 'Private', as expected. But there is no Permissions link next to 'Private' as I am used to seeing, so this is a problem and I'd like to know how to best approach remedying that.

The documentation on roles seems to say that the role of user allows changing one's own permissions on searches. But The role of user does not have write access in the permissions of the search app, and one splunk answer I read said that if the user does not have write permissions in the app they can't change the permissions of a saved search. So this is a dilemma for me. Is there a good way around this?

I've no desire to make the role inherit from power-user, and I really don't want to change allow the user role to have write-access in the search app. Can I have this one person in the group but abstract him off another level and given just him the ability to share with his co-workers somehow?

The /opt/splunk/etc/system/local/authorize.conf file stanza for this role looks like this:

    [role_user_wsg]
importRoles = user
rtSrchJobsQuota = 0
srchDiskQuota = 0
srchFilter = tag::host=oit_wsg
srchIndexesAllowed = *
srchIndexesDefault = *
srchJobsQuota = 0

wrangler2x
Motivator

I see that this question has been asked before. The answer appears to be that the user must be given write permission in the Search app. However, in the Splunk answer that addresses this, the poser of the original question then asked:

Is there documentation describing all
of the consequences of giving a user
write permission to the search App? I
want to be aware of any security
implications that this change might
incur.

That is a great question, and no one has answered it. But at least I have the basic answer.

Here is the other splunk answer that addresses this:

http://answers.splunk.com/answers/5391/share-a-saved-search-without-admin-rights

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...