Configure access to manager consoles and apps in Splunk Enterprise

On Splunk Enterprise instances only, you can use the local.meta file to grant and restrict access to certain parts of your Splunk Enterprise instance.

This file is not accessible on Splunk Cloud instances. On a Splunk Cloud instance, use and edit roles with Splunk Web to grant access to your Splunk Cloud deployment.

Examples of managing access to manager consoles and Splunk apps

With the local.meta file, you can:

• Restrict users in custom roles to a specific app
• Let users who hold custom roles access administrator-level features

Grant admin roles to users

Some management abilities that belong to the admin role are unique to that role. These abilities do not automatically inherit from the admin role when you configure the role in Splunk Web or by using the authorize.conf configuration file.

For example, say you want to create a custom role that inherits all of the abilities of the admin role but that has limited access to search jobs. To do this, you would create a new role called "specialAdmin" and set it to inherit all of the capabilities of the admin role, as described in About defining roles on the Splunk platform with capabilities. Then, you would set your search limits, as described in About configuring role-based user access.

Restrict access to specific apps

You can also use the local.meta file to restrict access.

For example, say you want to allow a user access to only one dashboard view. To accomplish this, you could create an app for that view and assign the user role to that app. In this case, you can use the local.meta file to let the role view that app.

Add and remove access using the local.meta file

You can give or restrict access by editing the local.meta file to add the new role wherever you want it. This action is not possible on Splunk Cloud Platform instances, it is available only on Splunk Enterprise.

1. Locate the local.meta file. Its location depends on several factors.
   • If you want to edit access for the main search page, for example, the manager controls, look in $SPLUNK_HOME/etc/system/metadata/.
   • If you want to edit access to a particular app, look in $SPLUNK_HOME/etc/apps/<app_name>/metadata/.
   • If the directory for the desired location does not contain the file, you can copy the default version default.meta and rename the copied file to local.meta.

     Do not edit the default.meta file directly as you might need the default values in that file at a future time.

2. Open the local.meta file for editing.
3. In the local.meta file, add the name of the new role to the stanza that corresponds with the access you want. See the table at the end of this procedure for details.
4. Save the file and close it.
5. Restart Splunk Enterprise.

Default stanza	What it does
[manager/accesscontrols] access = read : [ * ], write : [ admin, power ]	Lets users read this app's contents, or access functions in the Splunk Web Manager page, depending on the directory you are in. Unless overridden by other metadata, lets only admin and power users share objects into this app.
[views] [manager/accesscontrols] access = read : [ * ], write : [ admin ]	Determines the access controls for the Manager page access.

Examples for using local.meta to grant and remove access to Splunk Enterprise components

Following are some examples of editing the local.meta file to customize access to parts of Splunk Enterprise.

Example 1: Configure a role that allows for user management but no data access

You set up a new role called "usermanager" that only inherits capabilities from the user role and does not inherit any searches or indexes. You want this role to be able to create and manage user accounts, but have no data access.

To configure this access, edit the following stanza of the local.meta file:

[manager/accesscontrols]
access = read : [ admin ], write : [ admin ]

To include the following:

[manager/accesscontrols]
access = read : [ admin, usermanager ], write : [ admin, usermanager ]

This lets the "usermanager" role that you created see and edit things in the "Access controls" pages in Splunk Enterprise Manager.

Example 2: Configure a role that lets users view, but not edit, pages in Manager

You set up a new role called "userview," that you want to access, but not edit, pages in Manager. In this case, only add the role to the "read" value:

[manager/accesscontrols]
access = read : [ admin, userview, usermanager ], write : [ admin, usermanager ]

You can also grant access to read the manager pages to any using the asterisk *, which acts as a wildcard:

[manager/accesscontrols]
access = read : [ * ], write : [ admin ]

Example 3: Configure a role that limits write access to an app or dashboard

You want a subset of users who can only read sales data that you specify. To accomplish this, you can create an app for the dashboard and then create a new role "salesusers."

In the local.meta file in your app directory, edit the following stanza:

[viewstates]
access = read : [ * ], write : [ * ]

to read:

[viewstates]
access = read : [ salesusers ], write : [ admin ]