Security

Can I add two roles to a user account in Splunk by using CLI command?

weiwongfaye
Engager

for example, I need to add an admin user with "can_delete" & "admin" role.

In splunk doc, I can see that the following command allow me to CHANGE the role to "can_delete", not ADD the roles besides admin.

./splunk edit user admin -role can_delete -auth admin:changeme

  • List item
Tags (3)

Julian_Gudiel_S
Explorer

You can also directly create a user with multiples roles:

splunk add user buddha -role user  -role power -role zen -realname "Siddhartha Gautama" -password changeme
0 Karma

darrenfuller
Contributor

i know its an old question, but in case others are searching for the same...

Yes, you can do that...

Take the following user

splunk add user buddha -role user -realname "Siddhartha Gautama" -password changeme 

After creation, the buddha user is a member of the user role.. To edit this user to have two roles: power and zen you would need two -role parameters sent to the command...

splunk edit user buddha -role power -role zen

Running

splunk list user

will show:

username:               buddha
full-name:              Siddhartha Gautama
role:                   power zen

Notice that the edit command added buddha to the "power" and "zen" roles and removed it from the "user" role that was set on the first command. "edit user -role" will completely replace the roles that the user had with the new list of roles.

hth

trocmm
New Member

Thx guys
really helpful

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...