Splunk Search

How to change default permissions for lookups?

coltwanger
Contributor

I'm wondering if there's a way to change the behavior of how Splunk applies permissions to lookups generated via | outputlookup?

Currently, if user SplunkA generates a lookup on data in IndexA, by default the lookup gets the permissions of the app it's being generated in. If user SplunkB is in a role that doesn't have access to IndexA, he now potentially has access to partial (or full) data that exists in IndexA by looking at that lookup (via |inputlookup or the Data Sets tab).

Is it possible to force user generated lookups to be private by default? Then, we can have an elevated user evaluate if they are appropriate to be shared globally, and then assign the correct role permissions at that time.

We are running Splunk 6.5.2.

0 Karma

splunkettes
Path Finder

Did you get an answer for this? I am also looking to change the default behavior of how lookups are created. A few years back I believe the default behavior was to create the lookup as a private object under the user's app directory... which was way better for object management. 

0 Karma

adonio
Ultra Champion

Hello coltwagner,
lookups are not in an index, when lookups are generated they are global and can be seen by all users.
examples are in screenshot as I cerated a lookup with the admin account under search app and searched this lookup with a different user (limited privileges) under a different app.
for the second part of your question, here is a good answer by @DalJeanis and @somesoni2 that summarizes it:
https://answers.splunk.com/answers/521382/can-we-create-outputlookup-table-user-based.html

alt text

alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...