Security

Why would a user be unable to access a globally shared event type?

Path Finder

We are currently running a distributed Splunk 6.2.3 environment. A custom app was created on one of our search heads which a limited number of individuals have access to. An event type was created within this app, and the permissions were subsequently updated to allow everyone read access. The details are as follows:

App = custom_app
Sharing = Global
Permissions = Read access was assigned to Everyone

A user who does not have access to the "custom_app" has attempted to access this event type, but was unable. When the user views the available event types (settings/event types), the above event type is not listed.

It was my understanding that since the permissions (sharing) were updated to "Global", users should be able to access the event type even though they do not have access to the app under which it was initially created. Is this not the case?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The app level permissions (which allows access to certain people/role only) has precedent over the object level permissions (which allows access to Everyone), hence user who doesn't have access to the app can't access anything defined within the app.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

The app level permissions (which allows access to certain people/role only) has precedent over the object level permissions (which allows access to Everyone), hence user who doesn't have access to the app can't access anything defined within the app.

View solution in original post

0 Karma