How to hide an app, but share access to its kvstore lookups for users?

[lassel]

I have an app that only powerusers should be able to access.
In that app, I maintain some kvlookups that regular users should be able to use for lookups.

This is from my transforms.conf:

[]
access = read : [ * ], write : [ power, admin ]

[transforms/index_lookup]
access = read : [ * ], write : [ admin, power ]
export = system

My problem is that if I lock down the [] block so read:[power], the regular users can no longer see the lookup table.

How can I hide the app and expose the lookup table?

[esix_splunk · Accepted solution]

It's tedious, but you need to define this for each knowledge object in your app context. Remembering that the [] is the default for all objects.

For your use case, it might be better to separate the KVStore lookup into its own app space with read for all, and your remaining app, keep your permissions for [] restricted to power.

[lassel]

I am not sure what an app space is? Is it just a new app?
I make a separate app for the lookups, I'll just get another app that I cannot hide.

[lassel]

In the end I merged my two apps into one that all users can access. Then I locked down the views that only power-users can see.

default.meta:

[views/secretdashboard]
access = read : [ power ], write : [ power ]