Splunk Search

How to hide an app, but share access to its kvstore lookups for users?

lassel
Communicator

I have an app that only powerusers should be able to access.
In that app, I maintain some kvlookups that regular users should be able to use for lookups.

This is from my transforms.conf:

[]
access = read : [ * ], write : [ power, admin ]

[transforms/index_lookup]
access = read : [ * ], write : [ admin, power ]
export = system

My problem is that if I lock down the [] block so read:[power], the regular users can no longer see the lookup table.

How can I hide the app and expose the lookup table?

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

It's tedious, but you need to define this for each knowledge object in your app context. Remembering that the [] is the default for all objects.

For your use case, it might be better to separate the KVStore lookup into its own app space with read for all, and your remaining app, keep your permissions for [] restricted to power.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

It's tedious, but you need to define this for each knowledge object in your app context. Remembering that the [] is the default for all objects.

For your use case, it might be better to separate the KVStore lookup into its own app space with read for all, and your remaining app, keep your permissions for [] restricted to power.

lassel
Communicator

I am not sure what an app space is? Is it just a new app?
I make a separate app for the lookups, I'll just get another app that I cannot hide.

0 Karma

lassel
Communicator

In the end I merged my two apps into one that all users can access. Then I locked down the views that only power-users can see.

default.meta:

[views/secretdashboard]
access = read : [ power ], write : [ power ]
0 Karma
Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...