Permissions on CLI to execute splunk add monitor

[dchang]

Hi, We deploy forwarders to provide data to Splunk indexers. Whom is permitted to run the command "splunk add monitor"? Is it only the splunk user that installed the agent/forwarder?

If I wanted to permit others to add new monitors to the splunk forwarder can I do so?

Thanks, Dennis

[dwaddle]

To use the CLI command you need a Splunk login (not an operating system login) that has the Splunk admin role. How this nets out depends on some things - you can configure LDAP authentication (even for your forwarders) and let them centrally authenticate / authorize that way. Or, you can use the default admin account and whatever password you set for it. You could also add a Splunk user just for this purpose.

Alternately, splunk add monitor will eventually end up changing an inputs.conf config file. You could configure filesystem permissions to allow others to access this file, and they could edit it as necessary to add new monitor inputs.