I need to assign a capability to an existing Splunk user, so that they can upload files to their own index themselves via the Splunk gui.
They currently have no view of the 'DATA INPUTS' parameter on the gui as they have basic search capability restricted to their own data in their own index.
I have tried adding the capability of 'INPUT_FILE' & 'LIST_INPUTS' but this doesn't work.
Has anyone done this already?
I was able to get this working by setting up a role with the following capabilities:
edit_monitor - Required to make the "Add Data" option show up in the settings menu.
indexes_edit - Required to make the users index name show up in the Indexes drop down when uploading the file.
edit_tcp - Required to get the file to actually upload. Without this capability the file upload would hang.
search - Required so the user can preview the uploaded file.
This is the absolute minimum set of capabilities necessary to make file uploads through SplunkWeb work for a user. In addition though, I did have to make these changes as well:
Note that this was all done on Splunk 6.2, you mileage may vary on other Splunk versions.
A better solution would be to use the Universal forwarder to monitor a drop folder on a machine they can access. They can just drop data files there as needed and have it get pulled in and indexed.
Setting data inputs up including one shot uploads is more an administrative function and dangerous to give end users.