Configuring Splunk - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 323

export = system
### VIEWSTATES: even normal users should be able to create shared
viewstates
[viewstates]
access = read : [ * ], write : [ * ]
export = system
Stepping through this snippet, we have:
• The [] stanza states that all users should be able to read everything in
this app but that only users with the admin or power roles should be
able to write to this app.
• The [eventtypes] , [props] , [transforms] , and [lookups] states say
that all configurations of each type in this app should be shared by all
users in all apps, by default. export=system is equivalent to Global
in the user interface.
• The [viewstates] stanza gives all users the right to share their viewstates
globally. A viewstate contains information about dashboard settings made
through the web application, for instance, chart settings. Without this, chart
settings applied to a dashboard or saved search would not be available.
Looking at local.meta , we see settings created by the web application for the
configurations we created through the web application.
[indexes/summary_impl_splunk]
access = read : [ * ], write : [ admin, power ]
[views/errors]
access = read : [ * ], write : [ admin, power ]
export = system
owner = admin
version = 4.3
modtime = 1339296668.151105000
[savedsearches/top%20user%20errors%20pie%20chart]
export = none
owner = admin
version = 4.3
modtime = 1338420710.720786000
[viewstates/flashtimeline%3Ah2v14xkb]
owner = nobody