Monitoring Splunk

What roles and Capabilities needs to assign in order to access the monitoring console with minimal rights ?

Engager

Hello,

in our environment we have monitoring instance install on separate server, and want to provide the read only access to one of the user so that he can monitor the general stuff but can not do any changes. So want to know what kind of roles and capabilities I need to assign to that user so that he can login to monitoring console and do the L1 activity.
Thanks.

0 Karma

New Member

Hi ,

There is no option for monitoring only the Splunk Console(Monitor Console in Splunk) as there is dependency on roles .I tested it our environment but that doesn't work

You can still create restrictive roles based on a current role or creating a new for a new user

0 Karma

SplunkTrust
SplunkTrust

hello there,

i think you can create a new role, add the user role to it as well as the following capabilities:

dispatch_rest_to indexers

and all the objects that start with: list_
also, you will have to allow that role to see date from internal indexes (starts with "_" underscore)
full list of capabilities here:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Security/Rolesandcapabilities#List_of_capabilitie...

hope it helps

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!