topic Re: Limited admin permission in Splunk in Security

Limited admin permission in Splunk

Cbr1sg — Fri, 17 Aug 2018 05:51:15 GMT

Hello all,
I want to create a limited admin role for our Splunk environment, this role allows user to view, execute or create anything, but can not edit/modify/delete any existing stuffs.
I see in the capabilities list of Splunk has edit* and list* but I dont see anything about create*.

Could you please help?

Thanks

Re: Limited admin permission in Splunk

deepashri_123 — Fri, 17 Aug 2018 06:22:49 GMT

Hey@Cbr1sg,

You can refer the following doc which describes the capabilities:
http://docs.splunk.com/Documentation/Splunk/7.1.2/Security/Rolesandcapabilities

Let me know if this helps!!

Re: Limited admin permission in Splunk

Cbr1sg — Fri, 17 Aug 2018 07:48:28 GMT

@deepashri,
Thanks, I've already gone through that doc but could not find the info that I want.

Re: Limited admin permission in Splunk

sudosplunk — Fri, 17 Aug 2018 13:13:44 GMT

Power user role can achieve this with little to no tweaking in capabilities. Did you try it already? If so, what was the issue?

Re: Limited admin permission in Splunk

Cbr1sg — Tue, 28 Aug 2018 10:01:49 GMT

@nittala_surya sorry for late reply, only now I have chance to test it. With few modifications in the capabilities, the power role indeed fulfills my requirements..

Thanks mate!

Re: Limited admin permission in Splunk

sudosplunk — Tue, 28 Aug 2018 12:17:40 GMT

Glad to hear that. I moved my comment to answer so that you can accept and close it. Thanks.