What capability is needed to create a new index?

[marcusnilssonmr]

What capability is needed to create a new index? There is a capability for editing an index, is that used for creation as well?

[jensonthottian]

I think using indexes_edit capability you would be able to change settings related to an index(file size and memory limits) and not create a new index. But I am not sure which specific capability gets you access to create a new index in Splunk web (maybe try with this edit_web_settings ).

Can you try with first indexes_edit capability and let us know your results.

[srikanth1213]

Hi jensonthottian , did you find any other capability apart from "indexes_edit " that one would require to create/edit index?