Creating shared views
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
As Splunk spreads across your organization, you will find you need to control access to data and create and maintain Splunk knowledge such as event types, tags, lookups, field extractions, saved searches, reports, and dashboards. This topic will discuss how to produce a troubleshooting or monitoring environment for others.
Note: This topic currently provides an outline, which will be expanded over time. The outline and contents may change.
- Different groups with different data needs
- Operations/IT
- Tier 1 - Make the data you capture in logs available to less technical staff who might not otherwise know what is relevant or where to look for it. Open the ability to do basic problem solving at lower levels, giving your customers intelligent service and letting them know you're not wasting their time.
- Developers
- Control data access and show users the data that is relevant to them
- Users/roles (see About users and roles in the Admin manual.)
- Different indexes for different data (see Specify one or multiple indexes in the User manual.)
- Create knowledge and tools
- Event-types/saved searches
- Interesting dashboards and form searches
- PDF reports
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.