Security

Can I add two roles to a user account in Splunk by using CLI command?

weiwongfaye
Engager

for example, I need to add an admin user with "can_delete" & "admin" role.

In splunk doc, I can see that the following command allow me to CHANGE the role to "can_delete", not ADD the roles besides admin.

./splunk edit user admin -role can_delete -auth admin:changeme

  • List item
Tags (3)

Julian_Gudiel_S
Explorer

You can also directly create a user with multiples roles:

splunk add user buddha -role user  -role power -role zen -realname "Siddhartha Gautama" -password changeme
0 Karma

darrenfuller
Contributor

i know its an old question, but in case others are searching for the same...

Yes, you can do that...

Take the following user

splunk add user buddha -role user -realname "Siddhartha Gautama" -password changeme 

After creation, the buddha user is a member of the user role.. To edit this user to have two roles: power and zen you would need two -role parameters sent to the command...

splunk edit user buddha -role power -role zen

Running

splunk list user

will show:

username:               buddha
full-name:              Siddhartha Gautama
role:                   power zen

Notice that the edit command added buddha to the "power" and "zen" roles and removed it from the "user" role that was set on the first command. "edit user -role" will completely replace the roles that the user had with the new list of roles.

hth

trocmm
New Member

Thx guys
really helpful

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...