Feature Request: A Role Needs What Capability to Be Able To Create an App?


Hello, everyone.

I've already looked at the following link:

And the answer provided in there was "Only Admins can create apps."

I don't know, I just can't wrap my head around that. I feel like that can't be correct and that it's a mistake. I really want to give some users the ability to generate new apps and dashboards, but I don't want to make them admins of everything Splunk. It seems almost silly to me that you'd have to be an admin just to gain that ability. Plus, the documentation here:

...mentions nothing of a need to be an Admin, though obviously the documentation may have just missed it. Does anyone here know for certain that you have to be an Admin to create an App? I mean, the Admin itself is just another role with a bunch of extra capabilities. I can delete the role and modify it to my heart's content, so there's gotta be something that allows the Admin role to create Apps, not that it just happens to be a role named "Admin".

Thanks, everyone!

  • James


Surprised this isn't answered but the answer is that you simply need the "admin_all_objects" capability.

Nothing more. Nothing less.

You can try it yourself by adding ALL capabilities. You can create an app.
Try it again and remove ONLY admin_all_objects. You can't create an app.
Try again and remove everything but add admin_all_objects. You can create an app.

In your original question you wanted to give specific users the ability to create apps. This capability is very VERY dangerous in the wrong hands. We had a user that had it (it was a specific capability required in a specific data base app) they proceeded to remove/delete all configurations across the entire system as they didn't realise they weren't inside their own sandbox environment.


Jun/2012 and no answer...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...