Administration

[bhavna_jain]

Hi, What capabilities are needed for a non admin role to create their own index.
I have tried with edit_index but its not working.

Plz suggest some solutions.

[okrabbe_splunk]

There is not a capability that is available that allows the creation of indexes in the way that you want.

I would argue this is not something you want a non-admin to do anyways because it could affect the storage of your indexer.

If you don't trust them to be an admin why would you trust them to allocate space on the indexer's disk?

What are you trying to accomplish by having users create indexes. Are you trying to secure data? Are you trying to segregate to make it easier to search?

[okrabbe_splunk]

ok. I would recommend that you look at setting some best practices for your users that are onboarding data. You can do this as an admin by setting up indexes for them to use if necessary.

However, if users are indexing data that is for the same purpose, it probably should exist in the same index. You would want to teach them how to search for their specific data based on hostname, source or sourcetype.

You should take some time and look through this manual:
http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor

[bhavna_jain]

I am trying to segregate so that there will not be any mess up. For ex. if there are two non admin users with same role and they are indexing data in the asme index than it won't be easy for them to search within their own data. but if they are uploading data in their own indexex it will be easy. So i want them to create their own index.