About "add data" button that on home screen after login

[yutaka1005]

In my environment I would like to create a role who can search specific index and have same "capability" as admin.

However, even if I give "capability" same as admin, the "add data" button is not be displayed on the home screen after login.
Even if I let the role that I made inherit the admin role, it was not displayed.

Examining, it seems that "add data" button is not displayed on home screen in role other than admin such as power and user.

I'd like to display this "add data" button in role other than admin role, what should I do?

I appreciate any information.

[paulbannister]

Hi There,

Have you ensured that the new role has capabilities such as "edit_monitor", "indexes_edit", "edit_tcp", "search" and "input_file"?, a list of the capabilities descriptions for the latest version is available here:

http://docs.splunk.com/Documentation/Splunk/6.5.3/Security/Rolesandcapabilities

Unless you've already done so you could create secondary ability roles for abilities such user, power and admin with no indexes assigned, then create roles with no abilities assigned but the specific indexes you require to grant access to the desired indexes, allowing you control over who has access to specific indexes

[yutaka1005]

Thank you for answering.

The role that I made is inheriting admin role, so I think it has these capabilities("edit_monitor", "indexes_edit", "edit_tcp", "search" and "input_file").

Also even if I gave all the capabilities to my role without inheriting other role, the result did not change.

Can't I display the "add data" button on the home screen with the role other than admin role?

[paulbannister]

I may need a bit more details from you then on this one, as I just replicated the situation (creating a role that inherited the admin role before assigning to a user) and the Add Data button appeared just fine under the "Settings" dropdown

Does the option not appear in the settings menu at all?

[yutaka1005]

I made new user named "user1" and new role named "role1" that is inherited the admin role.
And I applied "role1" to "user1", however it is a state that the "add data" button is not displayed on the home screen when logging in with user1.
My splunk ver is 6.5.2.

Not under the "Settings" dropdown. I want "add data" to be appeared on "Explore Splunk Enterprise". Just like attached image.

[yutaka1005]