Splunk App for VMware: What capabilities are needed for the Data Collection Node user (collection configuration) to perform scheduling tasks?

[flle]

Hi,

When configuring the Data Collection Nodes (DCN) in the collection configuration for the Splunk App for VMware, a "Splunk Forwarder Username" has to be provided. This user is used by the Scheduler to push the collection jobs to the DCNs.
By default, the admin user is used.

Does anyone know precisely what capabilities that forwarder user needs to perform the scheduling tasks?

I want to delegate the collection configuration setup to the VMWare Admins, but do not want to give them the admin password. So, I want to set up a dedicated user and role for the DCN scheduler with only the capabilities needed.

Thanks & regards
flle

[markusspitzli2 · Accepted solution]

Hi.

As far as I have experienced you need a user/role with "admin_all_objects" capabilities to push collection jobs on the DCN. I tried several different combination of capabilities, but it always results in the "admin_all_objects" capability.

You could create a role with only "admin_all_objects" capability, but without access to any index. In case of a misuse the account can't give himself additional rights or access to any index. The downside of this solution is that he's able to edit/delete/create knowledge objects.

Best Regards¨
Markus