Role Capability to Query Lookup

[dglass0215]

Hello, 

I am trying to figure out which Role Capability controls being able to use a lookup in a query.  If I select all the capabilities then the role certainly can query a lookup.  However if I select only the capabilities that I want the role to have, they lose the ability to query the lookup.  Looking at the documentation (https://docs.splunk.com/Documentation/Splunk/8.1.2/Security/Rolesandcapabilities) it does not specify which capability allows for the querying of a lookup.

Thanks!

David

[scelikok]

So, you should move the lookup to an app that both users have access. Your lookup level permissions will prevent unwanted access.

[Vardhan]

HI @dglass0215 ,

It depends on what permission you will give to the lookup file. If you give only admin and power user roles to read and write the lookup. Then the user needs a power user role to access the lookup files.

But if you give read access for everyone. Then user role will be sufficient to access the lookup in the query.

[dglass0215]

I think I found the problem but I do not know the solution.  While I have given read permission to the lookup specifically for the custom Role, the role does not have permission to the app that created the lookup.  Not sure what I can do.  I definitely DO NOT want the role to have access to the app but I need the role to be able to query the lookup.

Thanks!

David

[Vardhan]

Hi @dglass0215 ,

Ask someone who has access to that app to provide read permission to your custom role.

[dglass0215]

I am the admin who has access to that app.  The issue is that we do NOT want to give read access to the app for new custom role, but we want them to be able to query the Lookup.

[dglass0215]

The lookup has Read permission for Everyone (including the custom Role I am having issues with).  

Thanks!

David