All Apps and Add-ons

Splunk App for VMware: What capabilities are needed for the Data Collection Node user (collection configuration) to perform scheduling tasks?

flle
Path Finder

Hi,

When configuring the Data Collection Nodes (DCN) in the collection configuration for the Splunk App for VMware, a "Splunk Forwarder Username" has to be provided. This user is used by the Scheduler to push the collection jobs to the DCNs.
By default, the admin user is used.

Does anyone know precisely what capabilities that forwarder user needs to perform the scheduling tasks?

I want to delegate the collection configuration setup to the VMWare Admins, but do not want to give them the admin password. So, I want to set up a dedicated user and role for the DCN scheduler with only the capabilities needed.

Thanks & regards
flle

1 Solution

markusspitzli2
Explorer

Hi.

As far as I have experienced you need a user/role with "admin_all_objects" capabilities to push collection jobs on the DCN. I tried several different combination of capabilities, but it always results in the "admin_all_objects" capability.

You could create a role with only "admin_all_objects" capability, but without access to any index. In case of a misuse the account can't give himself additional rights or access to any index. The downside of this solution is that he's able to edit/delete/create knowledge objects.

Best Regards¨
Markus

View solution in original post

markusspitzli2
Explorer

Hi.

As far as I have experienced you need a user/role with "admin_all_objects" capabilities to push collection jobs on the DCN. I tried several different combination of capabilities, but it always results in the "admin_all_objects" capability.

You could create a role with only "admin_all_objects" capability, but without access to any index. In case of a misuse the account can't give himself additional rights or access to any index. The downside of this solution is that he's able to edit/delete/create knowledge objects.

Best Regards¨
Markus

Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...