Splunk Search

Which permission do I need to share sourcetype with users?


Hey everyone and I hope your having a great day!

I have configured a custom field extraction in the Splunk search app for my sourcetype but I don't have the possibility to share them with other users like I can do with another Splunk instance where I have the role Power (With Power role, I can share it no problem).

I don't want to assign myself the Power role since it's broad and wouldn't follow the rule of least privilege. For this reason which permission would I need to assign myself in order to be able to share my data extraction with other users?

Labels (1)
0 Karma

Esteemed Legend

Hi @test2001,

when you create a knowledge object (like a field) and share it (at App or Global level) you have to define the permissions for each role of your Splunk, at this moment you can give the permissions you need using the active roles of your Splunk.



0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...