topic How to allow users other than the admin to search the default "os" index for Splunk App for Unix and Linux? in All Apps and Add-ons

How to allow users other than the admin to search the default "os" index for Splunk App for Unix and Linux?

soleblazer — Tue, 04 Nov 2014 21:24:22 GMT

Hello.

I created a dashboard using some of the data from the Splunk App for Unix. Its in the default index called "os."

I notice that only the admin user of splunk can query info out of that index. Is there something I need to do to allow other users to do that? The issue I have is when I shared the dashboards, nobody can see the data within the panels except the admin user.

Re: How to allow users other than the admin to search the default "os" index for Splunk App for Unix and Linux?

martin_mueller — Tue, 04 Nov 2014 22:22:33 GMT

You can give users read permission to an index by editing their role (Settings -> Authentication -> Roles). There's two settings, indexes searched by default (what happens when you don't specify index=foo) and indexes searchable.

Out of the box all users can search all non-internal indexes, so they should already be able to search with index=os - if not, add that index to their indexes searchable setting.