How to update Lookup permissions in bulk in Enterprise Security

Applicability

Description

A custom role requires edit access to lookups and macros while preserving existing permissions for other roles. Updating individual knowledge object permissions is unnecessary when the objects are managed through Enterprise Security permissions.

Investigation

1. Identify the custom role that requires access to Enterprise Security-managed lookups and macros.
2. Confirm that the role is registered in the App Permissions Manager managed-role configuration.
3. Verify that the role appears on the Enterprise Security Roles and capabilities page after the configuration is saved.
4. Review the available lookup and macro ACL options for the registered role.

Resolution

1. In Splunk Web, navigate to Settings > Data Inputs.
2. Select App Permissions Manager > enforce_es_permissions.
3. Add the custom role to the comma-separated Managed Roles list.
4. Click Save.
5. Wait for the role to appear on the Enterprise Security All Configurations-> Roles and capabilities page.
6. Enable the required lookup and macro ACLs for the custom role.
7. Verify that the role can edit the intended lookups and macros and that existing role permissions remain available.

Related Links

• Splunk Enterprise Security documentation — Add custom roles and manage capabilities