https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15820#M434 <P>Hi stephen,<BR /> is this still a valid answer for splunk 4.3? or have further improvements been made?</P> <P>I will test them in my local.meta file and report back</P> Wed, 01 Aug 2012 18:12:44 GMT tpsplunk 2012-08-01T18:12:44Z https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15816#M430 <P>Hi,</P> <P>What is the capability to assign to a user role so that it is able to access and configure data inputs via "Manager &gt; Data Inputs" ?</P> <P>"list_inputs" is already in and I've also tried to include "edit_tcp", "edit_udp", "edit_monitor" but the user account is still unable to access data inputs..</P> Mon, 21 Jun 2010 15:02:57 GMT https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15816#M430 apro 2010-06-21T15:02:57Z https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15817#M431 <P>I don't know.</P> <P>Have you restarted and/or reloaded auth? Those sound sufficient, but not sure. Do you get a specific error? This might be better as a support inquiry, if you don't get a quick answer here.</P> Tue, 22 Jun 2010 01:44:59 GMT https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15817#M431 jrodman 2010-06-22T01:44:59Z https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15818#M432 <P>Have tried restarting splunk services but still the same..</P> <P>nope..no specific error as well...</P> Tue, 22 Jun 2010 09:19:19 GMT https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15818#M432 apro 2010-06-22T09:19:19Z https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15819#M433 <P>These pages are controlled by access control lists on manager objects rather than capabilities on the underlying splunk functionality. We're slowly moving splunkd from a capabilities-based model to an ACL model to better support granular control of various system and user objects.</P> <P>To make these visible, edit <CODE>$SPLUNK_HOME/etc/apps/search/metadata/local.meta</CODE> and add additional roles to the <CODE>read</CODE> attributes of the following stanzas:</P> <PRE><CODE>[manager/datainputstats] access = read : [ admin ], write : [ admin ] [manager/data_inputs_monitor] access = read : [ admin ], write : [ admin ] [manager/data_inputs_script] access = read : [ admin ], write : [ admin ] [manager/data_inputs_tcp_cooked] access = read : [ admin ], write : [ admin ] [manager/data_inputs_tcp_raw] access = read : [ admin ], write : [ admin ] [manager/data_inputs_udp] access = read : [ admin ], write : [ admin ] </CODE></PRE> Wed, 18 Aug 2010 00:44:08 GMT https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15819#M433 Stephen_Sorkin 2010-08-18T00:44:08Z https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15820#M434 <P>Hi stephen,<BR /> is this still a valid answer for splunk 4.3? or have further improvements been made?</P> <P>I will test them in my local.meta file and report back</P> Wed, 01 Aug 2012 18:12:44 GMT https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15820#M434 tpsplunk 2012-08-01T18:12:44Z https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15821#M435 <P>this did not work for me. I did it a little different- i am using searchead pooling and have a 'searchhead' app that is managed by my deployment server so i edited my searchhead/metadata/local.meta file and distrubuted it. once it showed up on my searchhead i restarted it and had the user try again- no luck. the user in question has a power user role so in each of the stanza's above I changed the access line to be: access = read : [ admin, power ], write : [ admin, power]</P> Wed, 01 Aug 2012 19:52:29 GMT https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15821#M435 tpsplunk 2012-08-01T19:52:29Z https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15822#M436 <P>with some help form splunk support this is now working. I had to do two things- one was make the changes to local.meta as explained by Stephen. It did need to go in the 'search' app. The second was to add the line "edit_monitor = enabled" under the appropriate role stanza in my local/authorize.conf file. after a restart of splunk the users in the edited role were able to use the add data app/button.</P> Thu, 09 Aug 2012 22:40:43 GMT https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15822#M436 tpsplunk 2012-08-09T22:40:43Z https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15823#M437 <P>Is this still valid? I have no [manager/data...... in that file at all. I do see the individual inputs that I would like my restricted user to have access to.. In my case they are website availability check (web_ping) inputs. I want certain users to be able to add or remove these checks. Can't find a particular capability to add to give view of the checks and ability to edit and do not see corresponding entries to what this article suggests 5 years ago...</P> Thu, 10 Sep 2015 16:52:35 GMT https://community.splunk.com/t5/Security/Capability-to-assign-to-user-role-to-view-and-add-data-inputs/m-p/15823#M437 cmahan 2015-09-10T16:52:35Z