Deployment Architecture

What capability is needed to create a new index?

Path Finder

What capability is needed to create a new index? There is a capability for editing an index, is that used for creation as well?

Tags (1)
0 Karma


I think using indexes_edit capability you would be able to change settings related to an index(file size and memory limits) and not create a new index. But I am not sure which specific capability gets you access to create a new index in Splunk web (maybe try with this edit_web_settings ).

Can you try with first indexes_edit capability and let us know your results.

0 Karma

Path Finder

Hi jensonthottian , did you find any other capability apart from "indexes_edit " that one would require to create/edit index?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...