Set default permissions to "all" for new views and saved searches?

[rjdargi]

Right now, when a user creates a new view or saved search, it defaults to Private. Only users with the "admin" role can change these permissions.

Is there a way to change the default behavior so that all users get R/W permissions on views and saved searches?

[woodcock]

Yes, you do this with default.meta; read about it below in the "Make objects globally available" section:

http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/SetPermissions

[rjdargi]

I've attempted to do that, I've added the following to my default.meta. It doesn't seem to work, as new or cloned views still have "Sharing" set to "Private". I want them to be shared with the App itself. Am I doing this wrong?

# This should at least do views.
[views]
access = read : [ * ], write : [ * ]
# This should handle all objects, right?
[]
access = read : [ * ], write : [ * ]

[woodcock]

You need to add export = system to each stanza for global effect.

[rjdargi]

Right, I don't want global effect, I want them to stay within the app, just not restricted to the current user.

[woodcock]

That should do it.