Splunk Search

Is there a way to use default.meta to lock down write access to field extractions?

the_wolverine
Champion

We are considering locking down access to share field extractions. Is anyone aware of a way to do this easily? We want users to share other KOs so we don't want to completely remove write access to the search app.

0 Karma
1 Solution

ben_leung
Builder

You need something like this in your local.meta in the search app:

[props]
access = read : [ admin ], write : [ admin ]
export = none

Locking it down to admin only and then from there allow which ever roles.
Also make sure the roles have capability to write in the search app first or this won't work.

View solution in original post

ben_leung
Builder

You need something like this in your local.meta in the search app:

[props]
access = read : [ admin ], write : [ admin ]
export = none

Locking it down to admin only and then from there allow which ever roles.
Also make sure the roles have capability to write in the search app first or this won't work.

the_wolverine
Champion

Thanks 🙂 It worked. To be clear this doesn't prevent the field extraction from being created. Users can still create their own private extractions, they just will not be able to share them.

[props]
export = system
access = read : [ * ], write : [ admin ]

[transforms]
export = system
access = read : [ * ], write : [ admin ]

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...