Almost all objects in Splunk have permissions associated with them. The permissions essentially have the following three options:
Private: Only the user that created the search can see or use the object, and only in the app where it was created
App: All users that have permission to read an object may use that object in the context of the app that contains the object
Global: All users that have permission to read an object may use that object in any app
To see a visible instance of permissions in action, let's look at our navigation.
In our application, Implementing Splunk App One, our navigation looks like this:
If you recall the navigation XML which we built earlier, this menu is controlled by the following XML:
<collection label="Views"> <view source="unclassified" /> </collection>
There is no mention of any of these dashboards. This is where they are coming from:
Advanced Charting is inherited from the Search app. Its permissions...