What capabilities are required for a role to allow users to run a search to check license usage logs?

[chris1]

Hi,

We are planning to give access to a few users to check the license usage and run the search below to find the server that is forwarding a large size of files.

index=_internal source=*license_usage.log type=Usage 
 | stats sum(b) as bytes by h 
 | eval MB = round(bytes/1024/1024,1)
 | fields h MB
 | rename h as host

And we are planning to create a new role for this operation and assigning it to specific users. Can someone suggest what all are capabilities needs to be assigned to that role to get this access? Thanks!

[jensonthottian]

Create a role "licenseuser" and give access to index "_internal". Give all users you want to run this query role as "licenseuser". This should do it.

If that doesnt work then give privilege as "license_tab" to the new role.

[chris1]

Thank you for your reply. I will check and confirm.

[jensonthottian]

Can you confirm if this resolved ur issue or not?