Role Capabilities for splunkd-log

[eekanem]

Hi, what is the minimum capability without admin_for_all for a non-admin user to access splunkd-log object?

[rupkumar4sec]

I am not sure what you mean by splunkd-log object but if you are trying to access splunkd internal logs, you just need to add  those internal indexes or "_*"  to srchIndexesAllowed . 

[eekanem]

That does not seem to be enough for me. I noticed that with the power user I could access the splunk internal logs so I added the capabilities to my role but it still does not work.