Security
Highlighted

Feature Request: A Role Needs What Capability to Be Able To Create an App?

Communicator

Hello, everyone.

I've already looked at the following link:

http://splunk-base.splunk.com/answers/13239/what-permscapabilities-needed-to-create-an-app

And the answer provided in there was "Only Admins can create apps."

I don't know, I just can't wrap my head around that. I feel like that can't be correct and that it's a mistake. I really want to give some users the ability to generate new apps and dashboards, but I don't want to make them admins of everything Splunk. It seems almost silly to me that you'd have to be an admin just to gain that ability. Plus, the documentation here:

http://docs.splunk.com/Documentation/Splunk/4.3.2/Developer/Step2BuildApp

...mentions nothing of a need to be an Admin, though obviously the documentation may have just missed it. Does anyone here know for certain that you have to be an Admin to create an App? I mean, the Admin itself is just another role with a bunch of extra capabilities. I can delete the role and modify it to my heart's content, so there's gotta be something that allows the Admin role to create Apps, not that it just happens to be a role named "Admin".

Thanks, everyone!

  • James
Highlighted

Re: Feature Request: A Role Needs What Capability to Be Able To Create an App?

Engager

Jun/2012 and no answer...

0 Karma
Highlighted

Re: Feature Request: A Role Needs What Capability to Be Able To Create an App?

Motivator

Surprised this isn't answered but the answer is that you simply need the "adminallobjects" capability.

Nothing more. Nothing less.

You can try it yourself by adding ALL capabilities. You can create an app.
Try it again and remove ONLY adminallobjects. You can't create an app.
Try again and remove everything but add adminallobjects. You can create an app.

In your original question you wanted to give specific users the ability to create apps. This capability is very VERY dangerous in the wrong hands. We had a user that had it (it was a specific capability required in a specific data base app) they proceeded to remove/delete all configurations across the entire system as they didn't realise they weren't inside their own sandbox environment.