topic Role to only upload data file via the GUI in Security

Role to only upload data file via the GUI

Alaza — Fri, 07 Aug 2020 13:36:13 GMT

Hello,

I need a restrict role for only upload data file.

I add this capability :

edit_monitor - Required to make the "Add Data" option show up in the settings menu.
indexes_edit - Required to make the users index name show up in the Indexes drop down when uploading the file.
edit_tcp - Required to get the file to actually upload. Without this capability the file upload would hang.
search - Required so the user can preview the uploaded file.

But the settings are not visible then.

The goal is to create a limited access account with only the rigth to upload data, nothing else.

Is it possible ?

Thanks for your help.

SPlunk version 8.1

Re: Role to only upload data file via the GUI

thambisetty — Fri, 07 Aug 2020 14:53:40 GMT

A better solution would be to use the Universal forwarder to monitor a drop folder on a machine they can access. They can just drop data files there as needed and have it get pulled in and indexed.
Setting data inputs up including one shot uploads is more an administrative function and dangerous to give end users.

Anyhow -

I have tried adding edit_monitor after cloning user role then I can see Add Data from settings and when I clicked on add data I can see only monitor option not upload option.

Re: Role to only upload data file via the GUI

Alaza — Fri, 07 Aug 2020 15:26:30 GMT

You just copy the solution of this subject 🤔 :

https://community.splunk.com/t5/Getting-Data-In/Capability-to-upload-data-files-via-the-gui-for-a-user/m-p/190518#M37928

But it dosn't work.

Re: Role to only upload data file via the GUI

thambisetty — Fri, 07 Aug 2020 15:32:22 GMT

Try to find the screenshot also I posted.

here we are trying to help community.

along with the copied answer from some other post, I have tested and posted my answer also.