Splunk Search

Is there a way to use default.meta to lock down write access to field extractions?

the_wolverine
Champion

We are considering locking down access to share field extractions. Is anyone aware of a way to do this easily? We want users to share other KOs so we don't want to completely remove write access to the search app.

0 Karma
1 Solution

ben_leung
Builder

You need something like this in your local.meta in the search app:

[props]
access = read : [ admin ], write : [ admin ]
export = none

Locking it down to admin only and then from there allow which ever roles.
Also make sure the roles have capability to write in the search app first or this won't work.

View solution in original post

ben_leung
Builder

You need something like this in your local.meta in the search app:

[props]
access = read : [ admin ], write : [ admin ]
export = none

Locking it down to admin only and then from there allow which ever roles.
Also make sure the roles have capability to write in the search app first or this won't work.

the_wolverine
Champion

Thanks 🙂 It worked. To be clear this doesn't prevent the field extraction from being created. Users can still create their own private extractions, they just will not be able to share them.

[props]
export = system
access = read : [ * ], write : [ admin ]

[transforms]
export = system
access = read : [ * ], write : [ admin ]

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...