Splunk Search

What Capabilities do I need to enable so a user can change sharing permission on their searches?

talbot7
Path Finder

What Capabilities do I need to enable so a user can change sharing permission on their searches?

mattness
Splunk Employee
Splunk Employee

Talbot7: The ability to manage sharing permissions for knowledge objects (such as saved searches, alerts, dashboards, tags, event types, and so on) is controlled at the app level. There are no capabilities involved.

As an Admin, click the Apps menu in the Splunk bar and click Manage Apps. Find the app that you want to adjust permissions for and open its Permissions settings. This opens the Permissions dialog for the app, where you determine which roles have read and write permissions for the knowledge objects contained within that app. Give your User role Write permissions for the app if you want them to be able to share knowledge objects such as saved searches.

Warning: Roles that have write permissions to an app can also delete knowledge objects belonging to that app.

For future reference I've added documentation about this functionality here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Manageknowledgeobjectpermissions#Enable...

lim2
Communicator

Hi @mattness assigned a savedsearch which admin created to a non-power userid which has a role to write to the savedsearch and to the app in which the savedsearch is in. But userid still cannot see the Edit button. What is missing?

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...