Splunk Search

What Capabilities do I need to enable so a user can change sharing permission on their searches?

talbot7
Path Finder

What Capabilities do I need to enable so a user can change sharing permission on their searches?

mattness
Splunk Employee
Splunk Employee

Talbot7: The ability to manage sharing permissions for knowledge objects (such as saved searches, alerts, dashboards, tags, event types, and so on) is controlled at the app level. There are no capabilities involved.

As an Admin, click the Apps menu in the Splunk bar and click Manage Apps. Find the app that you want to adjust permissions for and open its Permissions settings. This opens the Permissions dialog for the app, where you determine which roles have read and write permissions for the knowledge objects contained within that app. Give your User role Write permissions for the app if you want them to be able to share knowledge objects such as saved searches.

Warning: Roles that have write permissions to an app can also delete knowledge objects belonging to that app.

For future reference I've added documentation about this functionality here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Manageknowledgeobjectpermissions#Enable...

lim2
Communicator

Hi @mattness assigned a savedsearch which admin created to a non-power userid which has a role to write to the savedsearch and to the app in which the savedsearch is in. But userid still cannot see the Edit button. What is missing?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...