SPL2 module permissions

Configure an SPL2 module to allow Write, Read, or Execute permissions to each role in the Splunk platform instance.

An SPL2 module can be private or shared in an app.

  • If a module is private, only the owner of the module can see and work with it.

  • If a module is shared, other users of the app can see, edit, or use the contents of the module.

To control the level of access that other users have to a shared module, configure the module to selectively grant Write, Read, or Execute permissions to each role in the Splunk platform instance. You can configure module permissions when creating or cloning a module, or by selecting the Edit permissions action for a module for which you have Write access. For more information, see Create an SPL2 module or Manage SPL2 modules.

The following table describes each permission:

Permission nameDescription

Write

Allow users to see and update the contents of the module, and run the searches in the module.

Read

Allow users to see the contents of the module, and run the searches in the module.

Users with Read permission cannot update the contents of the module. However, they can clone the module and then update the permissions and contents of the cloned copy.

Execute

Allow users to run the searches in the module.

Users with Execute permission cannot update or see the contents of the module, so the module owner must export the searches as views. The other users can then import the views into their own modules and run searches on the views.