Monitoring Splunk
Highlighted

What roles and Capabilities needs to assign in order to access the monitoring console with minimal rights ?

Engager

Hello,

in our environment we have monitoring instance install on separate server, and want to provide the read only access to one of the user so that he can monitor the general stuff but can not do any changes. So want to know what kind of roles and capabilities I need to assign to that user so that he can login to monitoring console and do the L1 activity.
Thanks.

0 Karma
Highlighted

Re: What roles and Capabilities needs to assign in order to access the monitoring console with minimal rights ?

SplunkTrust
SplunkTrust

hello there,

i think you can create a new role, add the user role to it as well as the following capabilities:

dispatch_rest_to indexers

and all the objects that start with: list_
also, you will have to allow that role to see date from internal indexes (starts with "" underscore)
full list of capabilities here:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Security/Rolesandcapabilities#List
of_capabilities

hope it helps

Highlighted

Re: What roles and Capabilities needs to assign in order to access the monitoring console with minimal rights ?

New Member

Hi ,

There is no option for monitoring only the Splunk Console(Monitor Console in Splunk) as there is dependency on roles .I tested it our environment but that doesn't work

You can still create restrictive roles based on a current role or creating a new for a new user

0 Karma