Dashboards & Visualizations

Permissions required for alert creation and dashboard sharing?

anitiansherlock
Explorer

Hello!

We are working in an environment with extremely locked down permissions that are not under any of the standard user/admin accounts. The requirement for the environment is that all capabilities need to be completely granular and manually added.

We're looking for only the specific capabilities required to be added to our accounts that will allow us to:

  1. Share dashboards with read/write allowances to other users.
  2. Create alerts (specifically ones which will trigger on conditions and email out)

Any help is very appreciated! Thank you!

1 Solution

iandrews_splunk
Splunk Employee
Splunk Employee

creating alerts:

[capability::schedule_search]
* Lets a user schedule saved searches, create and update alerts, and review triggered alert information.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Authorizeconf

sharing dashboards:

"Users with read access can only save objects for themselves, and require write access to be able to share objects with other users."

seen on "manage apps > select an app > select permissions"

View solution in original post

iandrews_splunk
Splunk Employee
Splunk Employee

creating alerts:

[capability::schedule_search]
* Lets a user schedule saved searches, create and update alerts, and review triggered alert information.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Authorizeconf

sharing dashboards:

"Users with read access can only save objects for themselves, and require write access to be able to share objects with other users."

seen on "manage apps > select an app > select permissions"

anitiansherlock
Explorer

Great! Thank you for your help on this!

It sounds like the dashboard sharing permissions could be pretty far ranging in this case correct? We would need write permissions to the entire search app to do so?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...