Splunk Search

Is there a way to use default.meta to lock down write access to field extractions?

the_wolverine
Champion

We are considering locking down access to share field extractions. Is anyone aware of a way to do this easily? We want users to share other KOs so we don't want to completely remove write access to the search app.

0 Karma
1 Solution

ben_leung
Builder

You need something like this in your local.meta in the search app:

[props]
access = read : [ admin ], write : [ admin ]
export = none

Locking it down to admin only and then from there allow which ever roles.
Also make sure the roles have capability to write in the search app first or this won't work.

View solution in original post

ben_leung
Builder

You need something like this in your local.meta in the search app:

[props]
access = read : [ admin ], write : [ admin ]
export = none

Locking it down to admin only and then from there allow which ever roles.
Also make sure the roles have capability to write in the search app first or this won't work.

the_wolverine
Champion

Thanks 🙂 It worked. To be clear this doesn't prevent the field extraction from being created. Users can still create their own private extractions, they just will not be able to share them.

[props]
export = system
access = read : [ * ], write : [ admin ]

[transforms]
export = system
access = read : [ * ], write : [ admin ]

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...