topic Difference between ES Permissions page and Splunk native edit role page in Splunk Enterprise Security

Difference between ES Permissions page and Splunk native edit role page

splunkreal — Fri, 29 Mar 2024 22:46:35 GMT

Hello,

does editing ES roles on Permissions page is same as editing ES roles in Splunk's native edit role page?

I guess they both point to ES authorize.conf but native's one can work with custom roles?

Thanks.

Re: Difference between ES Permissions page and Splunk native edit role page

meetmshah — Sat, 30 Mar 2024 06:54:48 GMT

Hello @splunkreal, AFAIK Yes - both the ways will update the capabilities to the respective roles as mentioned here - https://docs.splunk.com/Documentation/ES/7.3.1/Install/ConfigureUsersRoles#Add_capabilities_to_a_role

Please accept the solution and hit Karma, if this helps!

Re: Difference between ES Permissions page and Splunk native edit role page

meetmshah — Wed, 03 Apr 2024 08:19:35 GMT

Hello @splunkreal, Just checking through if the issue was resolved or you have any further questions? If not, can you please accept the answer, so anyone in the future having the same question can get the solution quickly?

Re: Difference between ES Permissions page and Splunk native edit role page

splunkreal — Wed, 10 Apr 2024 13:21:14 GMT

Hello @meetmshah

how do you add custom ES roles on Permissions page?

In data/inputs/app_permissions_manager "Action is not available" "Current instance is running SHC"

There is only ess_analyst and ess_user

Thanks.