Almost everything you create in Splunk has permissions. To see all objects, navigate to Settings | All configurations:
Everything with the value system in the App column ships with Splunk. These items live in the $SPLUNK_HOME/etc/system directory. We will cover these different configuration types in Chapter 11, Configuring Splunk, but the important takeaway is that the Sharing settings affect nearly everything.
When you create new objects and configurations, it is important to share all related objects. For instance, in Chapter 7, Extending Search, we created lookups.
It is important that all three parts of the lookup definition are shared appropriately, or users will be presented with error messages.