How to add edit_sourcetypes to sc_admin

[edgarrity]

We want to disable Power Users from editing source types but still allow sc_admin the capability. We unchecked the edit_sourcetypes capability on the Edit Role dialog box for the Power User in Splunk Cloud, then went to the Edit Role for the sc-admin to enable that capability. However, after disabling edit_sourcetypes for the Power User, that capability does not show up in the Edit Role for any role and now no users can edit source types. How do we enable the edit_sourcetypes capability for only the sc_admin role?

[richgalloway]

You'll have to open a Support Request to get the capability restored.

In the future, I recommend against messing with the built-in roles.  Instead, clone the role and modify the clone then assign the cloned role to the appropriate users/groups.  It's a little more work at first, but avoids nasty surprises like that, plus it gives you something to fall back to.

[edgarrity]

I opened a support ticket.  Splunk manually re-enabled the capability.  However, they have not yet been able to determine why unchecking the edit_sourcetypes capability for the Power User role removed that capability from all roles and removed the ability to re-add it.

I will update this ticket with the fix for this bug when I get the response from Splunk.