How to create a Splunk User Account for only editing all User Accounts?

New Member

Hey Guys!

I want to be able to create a user account, that has only one capability (the edit_user), so that whenever someone forgets their password, they can log in to this user account and not be able to see or search for any data, but only be able to edit the other user accounts (if there is a way to only be able to edit their specific account that would be awesome). I tried creating a Splunk user account and added a role with only the edit_user but when I logged into that account and tried to go to the user access section to change a users account I got this page, which is displayed in the image. Any ideas on how to fix this?alt text

0 Karma

Ultra Champion

Hi qfulgham,
You can try and create a limited user role - inheritance from user and limit the data view by removing indexes from the Indexes box (bottom box) and add the edit_user capability. then have your edit_user inherent the new role.
Works for me on Windows 10 Splunk version 6.5.1
Hope it helps

0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...