Security

Share a saved search without admin rights?

wegordoniii
Engager

I have a group of splunk users that need to be able to create & share queries with one another. Unlike the older version of splunk, when a user saves a search it's made private and they aren't given an option to share it with others. The documentation on sharing saved searches assumes that you're an Administrator, but I need users without the Administrative role to be able to share saved searches.

Is it possible for a non-admin Splunk User to share a saved search with other non-admin Splunk Users without the intervention of a Splunk Administrator?

Thank you

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Yes they can, if they have "write" permissions to the app that they want to make it visible/shareable within.

View solution in original post

woodcock
Esteemed Legend
0 Karma

tuinteractive
Engager

no written docs sadly, but I was able to get some good info from support on this. the "write" bit for a user/role on the search app just lets them then modify attribute for their search. so lets them share their searches for example.

the user then can control on a given search who they want to read/write THAT search. read on the search lets folks run it. write let's them modify it.

So an example. say you have Bob,Mary in Role1, Joe,Gary in Role2. giving Role1,Role2 write access to "search app" just let's them share their objects. it does not give them global "write" access to ALL of search. which is I think the concern wegordoniii and wrangler2x had (as did we).

Then if Bob shares search SearchA with read to Role1,Role2. then all four users can run it. but only Bob can maintain/modify the search itself.

If Joe makes a SearchB and marks id read for Role1 and read&write for Role2 then:
- Bob and Mary will be able to just run the search
- Joe,Gary will be able to both make changes to the search.

gkanapathy
Splunk Employee
Splunk Employee

Yes they can, if they have "write" permissions to the app that they want to make it visible/shareable within.

wrangler2x
Motivator

I'd like to know the answer to this last question also. What are the security implications of that?

wegordoniii
Engager

Excellent; thank you!

Is there documentation describing all of the consequences of giving a user write permission to the search App? I want to be aware of any security implications that this change might incur.

TIA

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...