Security

Using import and export attributes in default.meta

ruchir
Explorer

Hi

I want to import a specific view(dashboard) in an app from another app having that particular view with permission as (This app only).
How to use import and export attributes in default.meta?

For e.g. app App1 is having view View1 with permission as This app only. I want to use this View1 in app App2 without making View1 as global. I want that only specific apps can use this View1.

How to configure default.meta to make this possible by using attributes import and export?

Thanks in advance 🙂

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The way I understand it, you can set import = theotherapp in your app to make theotherapp part of your app's namespace.
Setting export = system in theotherapp would make it globally shared, so that's not what you want.

This should be in http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Defaultmetaconf but isn't - do use the feedback box at the bottom of that page to get this added.

View solution in original post

evilgeorge
Explorer

If "import" is part of the *.meta spec, can we please get it documented?

martin_mueller
SplunkTrust
SplunkTrust

The way I understand it, you can set import = theotherapp in your app to make theotherapp part of your app's namespace.
Setting export = system in theotherapp would make it globally shared, so that's not what you want.

This should be in http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Defaultmetaconf but isn't - do use the feedback box at the bottom of that page to get this added.

samhughe
Path Finder

I know this is an old thread, but in case it helps anyone else, this does work (in 6.3.3) but you have to import the 'search' app as well. It seems that the import command overrides rather than appends to a hidden default where all apps import the 'search' app. Without including the 'search' app in the import I got errors trying to load the default search/flashtimeline page in the top level app.

martin_mueller
SplunkTrust
SplunkTrust

Apps should not influence the indexes searched.

Check your roles, do they have restrictions on the indexes searchable or searched by default?
Check your searches, do they specify indexes or rely on the indexes searched by default settings in the roles?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That looks just like what's working over here in default.meta, so I can't give you a different example.

This app uses the import statement as well: https://apps.splunk.com/app/1632/

ruchir
Explorer

Thanks Martin, it was helpful.
Now I'm able to import views in an app from another.

But now the app which imports other app is unable to search anything the way it used to.
It's only searching main Index. I want to search other indexes available but unable to do that. Seems like importing an app limits the data you can query. Is there any way by which I can resolve this so that I can query all the data available?

0 Karma

ruchir
Explorer

Thank you Martin.

I tried it but wasn't able to get it right. I updated default.meta of App2 as:

[]
import = App1

Its not working.

May be I'm not using the right syntax to import App1's view1 view in App2. It'll be great if you can help me with an example.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...