All Apps and Add-ons

Splunk App for VMware: What capabilities are needed for the Data Collection Node user (collection configuration) to perform scheduling tasks?

flle
Path Finder

Hi,

When configuring the Data Collection Nodes (DCN) in the collection configuration for the Splunk App for VMware, a "Splunk Forwarder Username" has to be provided. This user is used by the Scheduler to push the collection jobs to the DCNs.
By default, the admin user is used.

Does anyone know precisely what capabilities that forwarder user needs to perform the scheduling tasks?

I want to delegate the collection configuration setup to the VMWare Admins, but do not want to give them the admin password. So, I want to set up a dedicated user and role for the DCN scheduler with only the capabilities needed.

Thanks & regards
flle

1 Solution

markusspitzli2
Explorer

Hi.

As far as I have experienced you need a user/role with "admin_all_objects" capabilities to push collection jobs on the DCN. I tried several different combination of capabilities, but it always results in the "admin_all_objects" capability.

You could create a role with only "admin_all_objects" capability, but without access to any index. In case of a misuse the account can't give himself additional rights or access to any index. The downside of this solution is that he's able to edit/delete/create knowledge objects.

Best Regards¨
Markus

View solution in original post

markusspitzli2
Explorer

Hi.

As far as I have experienced you need a user/role with "admin_all_objects" capabilities to push collection jobs on the DCN. I tried several different combination of capabilities, but it always results in the "admin_all_objects" capability.

You could create a role with only "admin_all_objects" capability, but without access to any index. In case of a misuse the account can't give himself additional rights or access to any index. The downside of this solution is that he's able to edit/delete/create knowledge objects.

Best Regards¨
Markus

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...