Which permission do I need to share sourcetype with users?

[test2001]

Hey everyone and I hope your having a great day!

I have configured a custom field extraction in the Splunk search app for my sourcetype but I don't have the possibility to share them with other users like I can do with another Splunk instance where I have the role Power (With Power role, I can share it no problem).

I don't want to assign myself the Power role since it's broad and wouldn't follow the rule of least privilege. For this reason which permission would I need to assign myself in order to be able to share my data extraction with other users?

[gcusello]

Hi @test2001,

when you create a knowledge object (like a field) and share it (at App or Global level) you have to define the permissions for each role of your Splunk, at this moment you can give the permissions you need using the active roles of your Splunk.

Ciao.

Giuseppe