Security

Is it possible to restrict the capability "indexes_edit " to specific indexes?

Communicator

Title says it all.

We want to expand the "user" Role to create scheduled Reports (schedulesearch) and write them to summary index, for which a user capability "indexesedit". Otherwise, he will not be able to choose an index to write when editing the report.

Is it possible to restrict the "indexes_edit" capability to only write to a specific index and not to all indexes per default? I tried to restrict it by the "srchIndexesAllowed" but this does not have any effect.

0 Karma
1 Solution

Builder

I don't think you can do that and it's not a good idea, indexesedit would allow user to have access to all indexes when they navigate through settings--->data(indexes). That should be a admin-role capability....
Even if you create a new role with indexes
edit and restrict to specific index, they get access to all indexes...

It's a known issue in 7.2.1..
http://docs.splunk.com/Documentation/Splunk/7.2.1/ReleaseNotes/KnownIssues#SplunkWebandinterfaceissues
http://docs.splunk.com/Documentation/Splunk/7.2.1/Security/Rolesandcapabilities#Listofcapabilities

View solution in original post

0 Karma

Builder

I don't think you can do that and it's not a good idea, indexesedit would allow user to have access to all indexes when they navigate through settings--->data(indexes). That should be a admin-role capability....
Even if you create a new role with indexes
edit and restrict to specific index, they get access to all indexes...

It's a known issue in 7.2.1..
http://docs.splunk.com/Documentation/Splunk/7.2.1/ReleaseNotes/KnownIssues#SplunkWebandinterfaceissues
http://docs.splunk.com/Documentation/Splunk/7.2.1/Security/Rolesandcapabilities#Listofcapabilities

View solution in original post

0 Karma