How to allow non-root user to check the search head cluster status?

[vin02]

There is a requirement to allow non-root user to query the cluster status by executing clustat command. But the non-root users are not allowed to execute this command. How to implement the same?

[koshyk]

What we have done is , on the cluster Master (or server which holds the DMC or Monitoring Console), we have copied the searches and created a new app with such dashboards which are meant for users.

So in step by step
- create an App MY_stats_app
- Put dashboards, searches, useful things into this app
- Create role for such users who need to access this app (eg MY_ROLE_stats)
- Allow access to this app ONLY for the role

This will make your administration/management very flexible and can allow team-leads/groups/users to access this specific app with centralised management (whereby SH cluster status is just one dashboard or panel)

[vin02]

I have created one non root user 'splunk'. What will be the command to check the search head cluster status using splunk user?

[koshyk]

the above steps are in Splunk UI. So please log to UI and do the Monitoring Console steps