Monitoring Splunk

We need to give only DMC access to users from L1 team.

vikram_m
Path Finder

We need to give only DMC access to users from L1 team. We dont need the team to have admin or power role access can some one please help me with the capabiltiy we can use so that a set of users can only view the DMC console and raise alarms incase the Splunk cluster is not complete.

Tags (2)
0 Karma

MuS
Legend

Hi vikram_m,

you can create a new role with these settings:

[role_mc-users]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
dispatch_rest_to_indexers = enabled
importRoles = power;user
license_tab = enabled
list_deployment_client = enabled
list_deployment_server = enabled
list_forwarders = enabled
list_health = enabled
list_httpauths = enabled
list_indexer_cluster = enabled
list_indexerdiscovery = enabled
list_search_head_clustering = enabled
list_search_scheduler = enabled
list_settings = enabled
rest_properties_get = enabled
list_health = enabled
rest_apps_view = enabled
list_indexer_cluster = enabled
list_search_head_clustering = enabled
edit_dist_peer = enabled
srchIndexesAllowed = _*
srchIndexesDefault = _*
srchMaxTime = 0

and allow this role read access to the Monitoring Console app. This will do the task.

Hope this helps ...

cheers, MuS

adonio
Ultra Champion

Hello there,
the DMC relay heavily on data that resides in _* indexes. i splunk admins have access to these indexes but you can allow any other user to access those as well.
when configuring a role, scroll all the way down and ass "All Internal Indexes" to "Indexes" (last box on that page)
where do you have the DMC configured? if it is according to best practices and DMC has its own dedicated Splunk instance, i think the best way is to create that unique role and also allow only to this group access to that particular Splunk instance.
hope it helps

0 Karma

ddrillic
Ultra Champion

In addition, since the DMC or MC is an admin app you need to go and adjust its permissions -

alt text

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...