Minimal capabilities required for adding events via Splunk REST API

[yitzarad]

Hi,

I'm trying to add events into an existing index, via the REST API (specifically, using javascript-sdk).

Everything works fine when using a powerful user/role.

Now, I'm trying to limit the capabilities of that user, but cannot find any relevant capability for adding data into index, via the REST API.

What are the "least privileges" in this case?

[LukeMurphey · Accepted solution]

You'll need "edit_tcp" to be able create events via the "/services/receivers/simple" API.

[LukeMurphey]

Yeah, no doubt! I only found out what the necessary permission was after spending way to much on it.

[yitzarad]

It's working, thank you!
BTW, "edit_tcp" is not so indicative description... 😕