Limit administrator capabilities

[cafissimo]

Hello, I would like to know if is it possible and how to hide logs for the administrator user (or role), user that would be able to modify only configurations, without seeing data. Thanks in advance, Luca.

[Simeon · Accepted solution]

You can set certain privileges via the UI, such as the allowed indexes. Creating a role that does not have search capabilities or searchable indexes would accomplish this. However, since the admin role (by default) has capabilities to edit these same capabilities you would need to disable that functionality. The capabilities that will minimally need disabling are:

change_authentication  
edit_roles         
search        

Also, you would disable all allowed and searchable indexes:

srchIndexesAllowed = 
srchIndexesDefault = 

Both of these edits can be performed in authorize.conf or via the UI in the Access Control portion of the manager tool.

http://www.splunk.com/base/Documentation/latest/Admin/Addusersandassignroles http://www.splunk.com/base/Documentation/latest/Admin/Authorizeconf