Capability needed for 'Log event' alert action

[ischoenmaker]

Does anyone know what capability to assign to a user to be able to use the 'log event' alert action?
The user has OOB power role but when he replicates one of my examples with log event action the events never reach the index. As soon as I reassign the object to my account (OOB Admin role) it works. Seems to be permission issue. From _audit log I also see the alert_actions=logevent is not even started for him:

Alternatively i can create the searches in my name and configure the log event action. I think in this way the power user can still modify the search when needed and log event will keep working.

[mgranger1]

In the documentation located here:

https://docs.splunk.com/Documentation/Splunk/7.2.4/Alert/LogEvents

It mentions that "Using the log event alert action requires the edit_tcp capability for users without the admin role."

I'm not positive that this will work for you, but it is certainly a place to start.

Hope this helps,
Matt Granger