Splunk Search

Will wildcards work in the default.meta?

the_wolverine
Champion

Does anyone know whether wildcards will work in the default.meta? Trying to avoid having to update the file when new objects are created.

E.g.

[lookups]
access = read : [ * ], write : [ admin, power ]
export = none

[lookups/lookup*]
access = read : [ * ], write : [ admin, power ]
export = none
owner = admin

So if I create a new lookup file with name starting with "lookup", it will automatically be owned by admin with proper permissions.

0 Karma
1 Solution

the_wolverine
Champion

Unfortunately, it appears that wildcards are not supported in default.meta.

View solution in original post

0 Karma

the_wolverine
Champion

Unfortunately, it appears that wildcards are not supported in default.meta.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Any reason why the main node wouldn't work? It's all the same imho:

[lookups]
access = read : [ * ], write : [ admin, power ]
export = none
owner = admi

Same as

[lookups]
access = read : [ * ], write : [ admin, power ]
export = none
owner = admin

[lookups/*]
access = read : [ * ], write : [ admin, power ]
export = none
owner = admin

But to answer your question I see no reason why it wouldn't work. I see it all the time in other apps.

Actually in stanza names ... is any number of characters and * is anything in between the slashes. Other than that, it's standard regex.

So this should work:

[lookups/...]

Guess you should test and let me know 😉

0 Karma

the_wolverine
Champion

Update: Using wildcard * does not work in default.meta.

0 Karma

the_wolverine
Champion

I discovered that if you set the owner in the main stanza, it prevents any user (other than the specified owner) from sharing that object at the app-level.

jkat54
SplunkTrust
SplunkTrust

Good to know!

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...