How to create a Splunk User Account for only editing all User Accounts?

[qfulgham]

Hey Guys!

I want to be able to create a user account, that has only one capability (the edit_user), so that whenever someone forgets their password, they can log in to this user account and not be able to see or search for any data, but only be able to edit the other user accounts (if there is a way to only be able to edit their specific account that would be awesome). I tried creating a Splunk user account and added a role with only the edit_user but when I logged into that account and tried to go to the user access section to change a users account I got this page, which is displayed in the image. Any ideas on how to fix this?

[adonio]

Hi qfulgham,
You can try and create a limited user role - inheritance from user and limit the data view by removing indexes from the Indexes box (bottom box) and add the edit_user capability. then have your edit_user inherent the new role.
Works for me on Windows 10 Splunk version 6.5.1
Hope it helps