https://community.splunk.com/t5/Security/role-permission/m-p/103472#M3331 <P>I create a role <BR /> [role_mmuser]</P> <P>admin_all_objects = enabled<BR /> change_authentication = enabled<BR /> edit_deployment_client = enabled<BR /> list_deployment_client = enabled<BR /> edit_deployment_server = enabled<BR /> edit_dist_peer = enabled<BR /> edit_forwarders = enabled<BR /> edit_httpauths = enabled<BR /> edit_input_defaults = enabled<BR /> edit_monitor = enabled<BR /> edit_roles = enabled<BR /> edit_scripted = enabled<BR /> edit_search_server = enabled<BR /> edit_server = enabled<BR /> edit_splunktcp = enabled<BR /> edit_splunktcp_ssl = enabled<BR /> edit_tcp = enabled<BR /> edit_udp = enabled<BR /> edit_user = enabled<BR /> edit_web_settings = enabled<BR /> indexes_edit = enabled<BR /> license_edit = enabled<BR /> license_tab = enabled<BR /> list_forwarders = enabled<BR /> list_httpauths = enabled<BR /> rest_apps_management = enabled<BR /> restart_splunkd = enabled</P> <H1>This enables the windows specific capabilities for admin</H1> <P>edit_win_eventlogs = enabled<BR /> edit_win_wmiconf = enabled<BR /> edit_win_regmon = enabled<BR /> edit_win_admon = enabled<BR /> edit_win_perfmon = enabled<BR /> list_win_localavailablelogs = enabled<BR /> list_pdfserver = enabled<BR /> write_pdfserver = enabled</P> <P>importRoles = power;user<BR /> srchIndexesAllowed = <EM>;_</EM><BR /> srchIndexesDefault = main;os<BR /> srchFilter = *<BR /> srchTimeWin = 0<BR /> srchDiskQuota = 10000<BR /> srchJobsQuota = 50<BR /> rtSrchJobsQuota = 100</P> <P>I have made it the same as admin, but still can't input data?Why and how? Thanks! </P> Mon, 28 Sep 2020 12:07:05 GMT benjiminhugh 2020-09-28T12:07:05Z https://community.splunk.com/t5/Security/role-permission/m-p/103472#M3331 <P>I create a role <BR /> [role_mmuser]</P> <P>admin_all_objects = enabled<BR /> change_authentication = enabled<BR /> edit_deployment_client = enabled<BR /> list_deployment_client = enabled<BR /> edit_deployment_server = enabled<BR /> edit_dist_peer = enabled<BR /> edit_forwarders = enabled<BR /> edit_httpauths = enabled<BR /> edit_input_defaults = enabled<BR /> edit_monitor = enabled<BR /> edit_roles = enabled<BR /> edit_scripted = enabled<BR /> edit_search_server = enabled<BR /> edit_server = enabled<BR /> edit_splunktcp = enabled<BR /> edit_splunktcp_ssl = enabled<BR /> edit_tcp = enabled<BR /> edit_udp = enabled<BR /> edit_user = enabled<BR /> edit_web_settings = enabled<BR /> indexes_edit = enabled<BR /> license_edit = enabled<BR /> license_tab = enabled<BR /> list_forwarders = enabled<BR /> list_httpauths = enabled<BR /> rest_apps_management = enabled<BR /> restart_splunkd = enabled</P> <H1>This enables the windows specific capabilities for admin</H1> <P>edit_win_eventlogs = enabled<BR /> edit_win_wmiconf = enabled<BR /> edit_win_regmon = enabled<BR /> edit_win_admon = enabled<BR /> edit_win_perfmon = enabled<BR /> list_win_localavailablelogs = enabled<BR /> list_pdfserver = enabled<BR /> write_pdfserver = enabled</P> <P>importRoles = power;user<BR /> srchIndexesAllowed = <EM>;_</EM><BR /> srchIndexesDefault = main;os<BR /> srchFilter = *<BR /> srchTimeWin = 0<BR /> srchDiskQuota = 10000<BR /> srchJobsQuota = 50<BR /> rtSrchJobsQuota = 100</P> <P>I have made it the same as admin, but still can't input data?Why and how? Thanks! </P> Mon, 28 Sep 2020 12:07:05 GMT https://community.splunk.com/t5/Security/role-permission/m-p/103472#M3331 benjiminhugh 2020-09-28T12:07:05Z https://community.splunk.com/t5/Security/role-permission/m-p/103473#M3332 <P>If you have a specific role that is identical to admin but yet you cannot do things admin can do, there are two major possibilities.</P> <OL> <LI>We have an error where we are keying to the admin role name incorrectly in the python or compiled code</LI> <LI>The access information for the views simply refer to the admin role, eg $SPLUNK_HOME/etc/apps/search/metadata/local.meta / default.met</LI> </OL> <P>The second scenario is more likely.</P> Fri, 20 Jul 2012 15:00:36 GMT https://community.splunk.com/t5/Security/role-permission/m-p/103473#M3332 jrodman 2012-07-20T15:00:36Z