Splunk Apps » Lookup Editor

Steps to repro:

1. Make a collection with the admin user
2. Try to load the collection as a non-admin

These appear to be getting made in the admin user. Perhaps I should make them in the nobody user?

The lookups are still made with the admin user even when the owner is set to "nobody".

I wonder, can a user load the lookup under their own account?

You can load a lookup under your user account but it is defined as read-only.

The API doesn't seem to indicate any way to make the lookup readable by other people.

See http://docs.splunk.com/Documentation/Splunk/6.3.0/RESTREF/RESTkvstore

• https://answers.splunk.com/answers/144000/modifying-acl-saved-search-permissions-through-rest-api-using-python.html
• https://answers.splunk.com/answers/388854/how-can-i-change-the-permissions-of-dynamically-cr.html
• https://answers.splunk.com/answers/48646/modify-event-types-via-api-curl.html
• https://answers.splunk.com/answers/115781/change-the-owner-of-a-saved-search-via-rest.html

I have this wired up but I am getting the following error against /servicesNS/nobody/lookup_editor/storage/collections/config/test_lookup_nobody/_acl:

action=_acl is not supported on individual entities

You can see this by navigating to https://127.0.0.1:8089/servicesNS/nobody/lookup_editor/storage/collections/config/test_lookup_nobody/_acl

Same error on a CSV lookup: https://127.0.0.1:8089/servicesNS/nobody/lookup_editor/data/lookup-table-files/test_lookup_nobody.csv/_acl and https://127.0.0.1:8089/services/data/lookup-table-files/test_lookup_nobody.csv/_acl

Maybe I am doing this wrong.

This can be adjusted within Core: http://dev.splunk.com/view/webframework-developapps/SP-CAAAE88

For example, see:

http://127.0.0.1:8000/en-US/manager/permissions/launcher/storage/collections/config/test_lookup_nobody?uri=%2FservicesNS%2Fnobody%2Flookup_editor%2Fstorage%2Fcollections%2Fconfig%2Ftest_lookup_nobody

You can edit the ACLs for these files in the Manager. To this end, I have added a link to open the editor from the lookup editor.