Is it possible to tell splunk what the default permissions should be when an object is created from the Splunk UI?
The best analogy I could think of is the unix "umask" tool that sets a mask for which permissions can be given to a newly created file by default. I'm wondering if there is any such concepts for objects created from within splunk.
For example, new objects are created privately by default. Which works well for many things, but it can be a serious pain when creating new tags, for example. (And even worse when tagging a newly created eventtype.) So is it possible to setup splunk to make tags application-level (or global-level) when they are created, instead of making them private by default?
I know you can setup a default.meta in your own custom app with something like this:
[tags]
access = read : [ * ], write : [ power ]
export = system
Which will make any existing tag in tags.conf (that have no explicit meta entry) readable to all, across all apps, and modifying to the "power" role, however newly created tags are just private. Can this be configured?
