Problem with a user's ability to set permissions on a saved search


I have created a role for a group of users for whom we are collecting their Windows Exchange logs and Windows events logs. This role inherits from 'user'. Things have been fine, but one user wanted to share a saved search with other members of his group (user_wsg). The search is shows in the manager (Searches and Reports) as part of the Search App, and it under sharing it is the default 'Private', as expected. But there is no Permissions link next to 'Private' as I am used to seeing, so this is a problem and I'd like to know how to best approach remedying that.

The documentation on roles seems to say that the role of user allows changing one's own permissions on searches. But The role of user does not have write access in the permissions of the search app, and one splunk answer I read said that if the user does not have write permissions in the app they can't change the permissions of a saved search. So this is a dilemma for me. Is there a good way around this?

I've no desire to make the role inherit from power-user, and I really don't want to change allow the user role to have write-access in the search app. Can I have this one person in the group but abstract him off another level and given just him the ability to share with his co-workers somehow?

The /opt/splunk/etc/system/local/authorize.conf file stanza for this role looks like this:

importRoles = user
rtSrchJobsQuota = 0
srchDiskQuota = 0
srchFilter = tag::host=oit_wsg
srchIndexesAllowed = *
srchIndexesDefault = *
srchJobsQuota = 0


I see that this question has been asked before. The answer appears to be that the user must be given write permission in the Search app. However, in the Splunk answer that addresses this, the poser of the original question then asked:

Is there documentation describing all
of the consequences of giving a user
write permission to the search App? I
want to be aware of any security
implications that this change might

That is a great question, and no one has answered it. But at least I have the basic answer.

Here is the other splunk answer that addresses this:

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...