topic Re: Minimal capabilities required for adding events via Splunk REST API in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Minimal-capabilities-required-for-adding-events-via-Splunk-REST/m-p/89632#M18603 <P>It's working, thank you!<BR /> BTW, "edit_tcp" is not so indicative description... <span class="lia-unicode-emoji" title=":confused_face:">😕</span></P> Tue, 09 Jul 2013 20:33:07 GMT yitzarad 2013-07-09T20:33:07Z Minimal capabilities required for adding events via Splunk REST API https://community.splunk.com/t5/Getting-Data-In/Minimal-capabilities-required-for-adding-events-via-Splunk-REST/m-p/89630#M18601 <P>Hi,</P> <P>I'm trying to add events into an existing index, via the REST API (specifically, using javascript-sdk).</P> <P>Everything works fine when using a powerful user/role.</P> <P>Now, I'm trying to limit the capabilities of that user, but cannot find any <A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Security/Rolesandcapabilities">relevant capability</A> for adding data into index, via the REST API.</P> <P>What are the "least privileges" in this case?</P> Tue, 09 Jul 2013 17:13:22 GMT https://community.splunk.com/t5/Getting-Data-In/Minimal-capabilities-required-for-adding-events-via-Splunk-REST/m-p/89630#M18601 yitzarad 2013-07-09T17:13:22Z Re: Minimal capabilities required for adding events via Splunk REST API https://community.splunk.com/t5/Getting-Data-In/Minimal-capabilities-required-for-adding-events-via-Splunk-REST/m-p/89631#M18602 <P>You'll need "edit_tcp" to be able create events via the "/services/receivers/simple" API.</P> Tue, 09 Jul 2013 20:06:23 GMT https://community.splunk.com/t5/Getting-Data-In/Minimal-capabilities-required-for-adding-events-via-Splunk-REST/m-p/89631#M18602 LukeMurphey 2013-07-09T20:06:23Z Re: Minimal capabilities required for adding events via Splunk REST API https://community.splunk.com/t5/Getting-Data-In/Minimal-capabilities-required-for-adding-events-via-Splunk-REST/m-p/89632#M18603 <P>It's working, thank you!<BR /> BTW, "edit_tcp" is not so indicative description... <span class="lia-unicode-emoji" title=":confused_face:">😕</span></P> Tue, 09 Jul 2013 20:33:07 GMT https://community.splunk.com/t5/Getting-Data-In/Minimal-capabilities-required-for-adding-events-via-Splunk-REST/m-p/89632#M18603 yitzarad 2013-07-09T20:33:07Z Re: Minimal capabilities required for adding events via Splunk REST API https://community.splunk.com/t5/Getting-Data-In/Minimal-capabilities-required-for-adding-events-via-Splunk-REST/m-p/89633#M18604 <P>Yeah, no doubt! I only found out what the necessary permission was after spending way to much on it.</P> Tue, 09 Jul 2013 20:41:16 GMT https://community.splunk.com/t5/Getting-Data-In/Minimal-capabilities-required-for-adding-events-via-Splunk-REST/m-p/89633#M18604 LukeMurphey 2013-07-09T20:41:16Z