admin管理员组

文章数量:1125726

To configure granular permissions within a custom app in Splunk we can use the default.meta to set permissions for roles. We are using a custom app to deploy all our savedsearches (and other configurations) and we would like to make it impossible for anyone to make changes in the GUI to these searches as that would create "local" changes that I cannot overwrite easily in Splunk Cloud.

I deployed a default.meta with:

[]
access = read : [ * ], write : []
export = system

Thinking this would make sure that everyone can read but no one can write changes. But it turns out that as an admin I can just disable savedsearches through the GUI.

The question: How can I give no-one write access on any of the objects deployed through my app?

本文标签: Splunk meta configuration to not allow admin write permissionStack Overflow