https://community.splunk.com/t5/Alerting/Capability-needed-for-Log-event-alert-action/m-p/442814#M7773 <P>Does anyone know what capability to assign to a user to be able to use the 'log event' alert action?<BR /> The user has OOB power role but when he replicates one of my examples with log event action the events never reach the index. As soon as I reassign the object to my account (OOB Admin role) it works. Seems to be permission issue. From _audit log I also see the alert_actions=logevent is not even started for him:<BR /> <IMG src="https://community.splunk.com/storage/temp/251195-2018-07-12-16-13-51-clipboard.png" alt="alt text" /></P> <P>Alternatively i can create the searches in my name and configure the log event action. I think in this way the power user can still modify the search when needed and log event will keep working.</P> Tue, 29 Sep 2020 20:28:30 GMT ischoenmaker 2020-09-29T20:28:30Z https://community.splunk.com/t5/Alerting/Capability-needed-for-Log-event-alert-action/m-p/442814#M7773 <P>Does anyone know what capability to assign to a user to be able to use the 'log event' alert action?<BR /> The user has OOB power role but when he replicates one of my examples with log event action the events never reach the index. As soon as I reassign the object to my account (OOB Admin role) it works. Seems to be permission issue. From _audit log I also see the alert_actions=logevent is not even started for him:<BR /> <IMG src="https://community.splunk.com/storage/temp/251195-2018-07-12-16-13-51-clipboard.png" alt="alt text" /></P> <P>Alternatively i can create the searches in my name and configure the log event action. I think in this way the power user can still modify the search when needed and log event will keep working.</P> Tue, 29 Sep 2020 20:28:30 GMT https://community.splunk.com/t5/Alerting/Capability-needed-for-Log-event-alert-action/m-p/442814#M7773 ischoenmaker 2020-09-29T20:28:30Z https://community.splunk.com/t5/Alerting/Capability-needed-for-Log-event-alert-action/m-p/442815#M7774 <P>In the documentation located here:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/Alert/LogEvents">https://docs.splunk.com/Documentation/Splunk/7.2.4/Alert/LogEvents</A></P> <P>It mentions that "Using the log event alert action requires the edit_tcp capability for users without the admin role."</P> <P>I'm not positive that this will work for you, but it is certainly a place to start.</P> <P>Hope this helps,<BR /> Matt Granger</P> Thu, 14 Feb 2019 14:58:14 GMT https://community.splunk.com/t5/Alerting/Capability-needed-for-Log-event-alert-action/m-p/442815#M7774 mgranger1 2019-02-14T14:58:14Z