Security

Add power user permissions to all private Admin Reports and Lookups

DanielFordWA
Contributor

Hi,

There are over 100 reports created by the admin and set to private.

The request is to give the power user access to all the reports. I do not want to do this manually.

All the reports are in

Splunk\etc\users\admin\search\local\savedsearches.conf

The meta data is in

\Splunk\etc\users\admin\search\metadata\local.meta

Can I just copy all the save searches to

\Splunk\etc\apps\search\local\savedsearches.conf

and add to the meta file in...

\Splunk\etc\apps\search\metadata\local.meta

....the below for each search I have copied across?

access = read : [ admin, power ], write : [ admin, power ]

Will this cause any issues for the admin user?

Is this the correct way to go about moving a large number of reports?

Can I use the same method for lookups?

Thanks,

Dan

0 Karma
1 Solution

nromito_splunk
Splunk Employee
Splunk Employee

The way you describe is exactly how you should handle moving the savedsearches.conf file if you want the owner to be "nobody"; however, if you want the searches to still be owned by admin, then you need to add owner = admin to your local.meta file stanza as well. There shouldn't be any side effects for this. You could always test this by moving a small number of savedsearches first to ensure that no dashboards or reports are breaking, and then move the rest over.

This method should work for lookups as well.

View solution in original post

nromito_splunk
Splunk Employee
Splunk Employee

The way you describe is exactly how you should handle moving the savedsearches.conf file if you want the owner to be "nobody"; however, if you want the searches to still be owned by admin, then you need to add owner = admin to your local.meta file stanza as well. There shouldn't be any side effects for this. You could always test this by moving a small number of savedsearches first to ensure that no dashboards or reports are breaking, and then move the rest over.

This method should work for lookups as well.

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...