Right now, when a user creates a new view or saved search, it defaults to Private. Only users with the "admin" role can change these permissions.
Is there a way to change the default behavior so that all users get R/W permissions on views and saved searches?
Yes, you do this with default.meta
; read about it below in the "Make objects globally available" section:
http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/SetPermissions
I've attempted to do that, I've added the following to my default.meta. It doesn't seem to work, as new or cloned views still have "Sharing" set to "Private". I want them to be shared with the App itself. Am I doing this wrong?
# This should at least do views.
[views]
access = read : [ * ], write : [ * ]
# This should handle all objects, right?
[]
access = read : [ * ], write : [ * ]
You need to add export = system
to each stanza for global effect.
Right, I don't want global effect, I want them to stay within the app, just not restricted to the current user.
That should do it.