All Apps and Add-ons

Splunk App for VMware: What capabilities are needed for the Data Collection Node user (collection configuration) to perform scheduling tasks?

flle
Path Finder

Hi,

When configuring the Data Collection Nodes (DCN) in the collection configuration for the Splunk App for VMware, a "Splunk Forwarder Username" has to be provided. This user is used by the Scheduler to push the collection jobs to the DCNs.
By default, the admin user is used.

Does anyone know precisely what capabilities that forwarder user needs to perform the scheduling tasks?

I want to delegate the collection configuration setup to the VMWare Admins, but do not want to give them the admin password. So, I want to set up a dedicated user and role for the DCN scheduler with only the capabilities needed.

Thanks & regards
flle

1 Solution

markusspitzli2
Explorer

Hi.

As far as I have experienced you need a user/role with "admin_all_objects" capabilities to push collection jobs on the DCN. I tried several different combination of capabilities, but it always results in the "admin_all_objects" capability.

You could create a role with only "admin_all_objects" capability, but without access to any index. In case of a misuse the account can't give himself additional rights or access to any index. The downside of this solution is that he's able to edit/delete/create knowledge objects.

Best Regards¨
Markus

View solution in original post

markusspitzli2
Explorer

Hi.

As far as I have experienced you need a user/role with "admin_all_objects" capabilities to push collection jobs on the DCN. I tried several different combination of capabilities, but it always results in the "admin_all_objects" capability.

You could create a role with only "admin_all_objects" capability, but without access to any index. In case of a misuse the account can't give himself additional rights or access to any index. The downside of this solution is that he's able to edit/delete/create knowledge objects.

Best Regards¨
Markus

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...