How do I create the winfra-admin role?

[rmanni]

I am in the midst of deploying the Windows apps to monitor our AD environment, when I go to setup the Infrastructure app on our search head, I get the following error:

Users and/or groups configured with the winfra-admin user role:
No users or groups with winfra-admin user role detected.
Assign the winfra-admin user role via Splunk Settings >> Access Controls

However, I do not see a winfra-admin role when I go to assign that to a user/group? So is there a specific method to create this role given that it was not created when the app was deployed?

[jcrabb_splunk · Accepted solution]

Referencing this doc for the Windows Infrastructure app, it explains where different components are to be installed:

• http://docs.splunk.com/Documentation/MSApp/1.4.2/MSInfra/HowtodeploytheSplunkAppforWindowsInfrastruc...

For the Search Head you will see it requires "Splunk App for Windows Infrastructure". In the base app, under default, there is a authorize.conf with the new role. Did you deploy the app to the Search Head? If so, when you browse to the $SPLUNK_HOME/etc/apps/splunk_app_windows_infrastructure/default/ directory, do you see an authorize.conf file?

[rmanni]

Thanks, that is the guide I have been following so far. The authorize.conf file is in the default directory. Do I need to copy it to local?

[jcrabb_splunk]

No you shouldn't need to copy it to local. Have you restarted Splunk on the SH since installing the APP? If so, you can look at btool to see if something is taking a higher precedence.

From $SPLUNK_HOME/bin/

./splunk btool authorize list --debug

Do you see the settings?

[rmanni]

Thank you - I did not restart the Splunk service after deploying the app from our deployment server. The winfra-admin and windows-admin roles both show up now.

[jcrabb_splunk]

Glad its working for you. 🙂