Splunk Search

Is there a way to use default.meta to lock down write access to field extractions?

the_wolverine
Champion

We are considering locking down access to share field extractions. Is anyone aware of a way to do this easily? We want users to share other KOs so we don't want to completely remove write access to the search app.

0 Karma
1 Solution

ben_leung
Builder

You need something like this in your local.meta in the search app:

[props]
access = read : [ admin ], write : [ admin ]
export = none

Locking it down to admin only and then from there allow which ever roles.
Also make sure the roles have capability to write in the search app first or this won't work.

View solution in original post

ben_leung
Builder

You need something like this in your local.meta in the search app:

[props]
access = read : [ admin ], write : [ admin ]
export = none

Locking it down to admin only and then from there allow which ever roles.
Also make sure the roles have capability to write in the search app first or this won't work.

the_wolverine
Champion

Thanks 🙂 It worked. To be clear this doesn't prevent the field extraction from being created. Users can still create their own private extractions, they just will not be able to share them.

[props]
export = system
access = read : [ * ], write : [ admin ]

[transforms]
export = system
access = read : [ * ], write : [ admin ]

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...