How to protect from anyone creating lookup tables with outputlookup?

[sgarvin55]

It seems anyone can create a new lookup table, or overwrite an existing one's content. Is there a way to set permissions for this functionality?

[hexx · Accepted solution]

In order to keep users from creating non-existing lookup tables using outputlookup, the command would need to be defined in commands.conf, which would allow role-based permissions to be set. This doesn't seem to be the case, but keep in mind that outputlookup can only write to $SPLUNK_HOME/etc/system/lookups or to $SPLUNK_HOME/etc/apps/{app}/lookups

As for overwriting other users lookup tables with it, you should be able to prevent this by denying write permissions (in Splunk) to the tables that you don't want anyone messing with.

[raziasaduddin]

We just tested in 5.0.2.2 - A user did outputlookup and overwrote a lookup file in etc/system even though in the UI, users only have read access to the table definition and file. This is unacceptable. To be clear, the files have no owner since they were just created via editing transforms.conf and the lookup csv files themselves in the command line.