All Apps and Add-ons

Splunk App for VMware: What capabilities are needed for the Data Collection Node user (collection configuration) to perform scheduling tasks?

flle
Path Finder

Hi,

When configuring the Data Collection Nodes (DCN) in the collection configuration for the Splunk App for VMware, a "Splunk Forwarder Username" has to be provided. This user is used by the Scheduler to push the collection jobs to the DCNs.
By default, the admin user is used.

Does anyone know precisely what capabilities that forwarder user needs to perform the scheduling tasks?

I want to delegate the collection configuration setup to the VMWare Admins, but do not want to give them the admin password. So, I want to set up a dedicated user and role for the DCN scheduler with only the capabilities needed.

Thanks & regards
flle

1 Solution

markusspitzli2
Explorer

Hi.

As far as I have experienced you need a user/role with "admin_all_objects" capabilities to push collection jobs on the DCN. I tried several different combination of capabilities, but it always results in the "admin_all_objects" capability.

You could create a role with only "admin_all_objects" capability, but without access to any index. In case of a misuse the account can't give himself additional rights or access to any index. The downside of this solution is that he's able to edit/delete/create knowledge objects.

Best Regards¨
Markus

View solution in original post

markusspitzli2
Explorer

Hi.

As far as I have experienced you need a user/role with "admin_all_objects" capabilities to push collection jobs on the DCN. I tried several different combination of capabilities, but it always results in the "admin_all_objects" capability.

You could create a role with only "admin_all_objects" capability, but without access to any index. In case of a misuse the account can't give himself additional rights or access to any index. The downside of this solution is that he's able to edit/delete/create knowledge objects.

Best Regards¨
Markus

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...