rest command without admin account

[thielethomas]

Hi,

which role rights are necessary for using the rest command (http://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Rest#Syntax) in splunk searches ?

The search is just working with an admin account at the moment. When using power user account, I get:

REST Processor: Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/deployment/server/clients?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API.
Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/deployment/server/clients?count=0 from server=https://127.0.0.1:8089 - Forbidden

I already added all rest rights to poweruser role (rest_*).

[thielethomas · Accepted solution]

Hi maciep,

thanks for your hint !!!
I had to add "list_deployment_client" & "list_deployment_server" in order to get my dashboard working.

[maciep]

I could be mistaken, but I think the user would need to have access to whatever objects they're trying to access via rest. For example, can your power user log on to that Splunk instance and get to Forwarder Management manually (looks like you're trying to hit the deployment server)?