Security

How to create a Splunk User Account for only editing all User Accounts?

qfulgham
New Member

Hey Guys!

I want to be able to create a user account, that has only one capability (the edit_user), so that whenever someone forgets their password, they can log in to this user account and not be able to see or search for any data, but only be able to edit the other user accounts (if there is a way to only be able to edit their specific account that would be awesome). I tried creating a Splunk user account and added a role with only the edit_user but when I logged into that account and tried to go to the user access section to change a users account I got this page, which is displayed in the image. Any ideas on how to fix this?alt text

0 Karma

adonio
Ultra Champion

Hi qfulgham,
You can try and create a limited user role - inheritance from user and limit the data view by removing indexes from the Indexes box (bottom box) and add the edit_user capability. then have your edit_user inherent the new role.
Works for me on Windows 10 Splunk version 6.5.1
Hope it helps

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...