Splunk Search

Will wildcards work in the default.meta?

the_wolverine
Champion

Does anyone know whether wildcards will work in the default.meta? Trying to avoid having to update the file when new objects are created.

E.g.

[lookups]
access = read : [ * ], write : [ admin, power ]
export = none

[lookups/lookup*]
access = read : [ * ], write : [ admin, power ]
export = none
owner = admin

So if I create a new lookup file with name starting with "lookup", it will automatically be owned by admin with proper permissions.

0 Karma
1 Solution

the_wolverine
Champion

Unfortunately, it appears that wildcards are not supported in default.meta.

View solution in original post

0 Karma

the_wolverine
Champion

Unfortunately, it appears that wildcards are not supported in default.meta.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Any reason why the main node wouldn't work? It's all the same imho:

[lookups]
access = read : [ * ], write : [ admin, power ]
export = none
owner = admi

Same as

[lookups]
access = read : [ * ], write : [ admin, power ]
export = none
owner = admin

[lookups/*]
access = read : [ * ], write : [ admin, power ]
export = none
owner = admin

But to answer your question I see no reason why it wouldn't work. I see it all the time in other apps.

Actually in stanza names ... is any number of characters and * is anything in between the slashes. Other than that, it's standard regex.

So this should work:

[lookups/...]

Guess you should test and let me know 😉

0 Karma

the_wolverine
Champion

Update: Using wildcard * does not work in default.meta.

0 Karma

the_wolverine
Champion

I discovered that if you set the owner in the main stanza, it prevents any user (other than the specified owner) from sharing that object at the app-level.

jkat54
SplunkTrust
SplunkTrust

Good to know!

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...