Getting Data In

Is there a way to create user with admin rights and REST API access but no webui access?


We want to be able to create a Splunk user that has admin rights but can not log into the Splunk Web UI. This user will be used for REST API access only.

Splunk Employee
Splunk Employee

Very odd use case. I agree with @jonmargulies. I do not understand why the person get all admin permission without web access.

Well, give one splunk instance without running Splunkweb. But, again, if the user have full admin access, he/she may be able to enable SplunkWeb and restart Splunk.

0 Karma

Path Finder

Here are options that may solve your problem:
1) Switch Splunk to SSO strict mode and connect it to a single sign-on solution so the web UI no longer allows users to manually enter a username/password (documentation here: Then add all your WebUI users to the SSO solution, but add your admin/REST user to Splunk only--not the SSO solution. If that user ever tries to authenticate to the WebUI, the SSO solution will reject it. But when that user tries to authenticate on the management port, Splunk will bypass the SSO solution (you will have to add the source address that you expect REST queries to come from to the trustedIP list, and just for good measure you should have iptables specifically block the Splunk web port from that IP).

2) I bet you can do something similar to the above by setting up multifactor authentication using Duo ( My guess--I can't find any documentation that addresses it--is that the Splunk management port bypasses Duo just like it bypasses SSO. If that's the case, you'd just have to set up a second factor for the REST account and then destroy that second factor; that way that account can still use its username/password to login through the management port, but it won't have the second factor required to login to Splunk Web.

A couple of things you should consider if you do what you're intending: If you're giving this account admin privileges, it can create another account that has admin and web UI privileges (SSO example above notwithstanding). You can create an alert to look out for that, but this account can also disable that alert. You can create an alert that looks for the account disabling that alert, but... turtles all the way down. So think carefully about those possibilities before you put your trust in this solution.

Revered Legend

Based on what I can see from the capabilities that are available in Splunk, there is no capability that manages access to Splunk Web (see this, so my guess is that it's not possible to have a non web UI user/role.

0 Karma



0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...