Deployment Architecture

Which Splunk Capability allows to enable OR disable a Splunk app?

juhiacc
Explorer

We have a Splunk app, that needs to be disabled by the users themselves as per the systems health and maintenance mode. Curious to know which role/capability in splunk is responsible for granting this level of access.

Already have revisited `edit_local_apps` capability as part of https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Rolesandcapabilities#Add.2C_edit.2C_and_... and this doesn't seems to answer the query.

 

Thanks

Labels (1)
0 Karma

Siddharth
Path Finder

Try this it should work 


edit_local_appsLets the user edit actions for application management. Applies only when you set the enable_install_apps setting to "true" in authorize.conf.
0 Karma

sweetie
Explorer

Thanks @Siddharth ,  I do have enabled the capability edit_local_apps under role from UI. However I am not sure where exactly we need to make changes in authorize.conf. Thanks

0 Karma

Siddharth
Path Finder

in authorize.conf 

[capability::edit_local_apps]

enable = true 


I think this should work just debug/refresh the system once it is done 

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...