Limit administrator capabilities


Hello, I would like to know if is it possible and how to hide logs for the administrator user (or role), user that would be able to modify only configurations, without seeing data. Thanks in advance, Luca.

0 Karma

Re: Limit administrator capabilities

Splunk Employee
Splunk Employee

You can set certain privileges via the UI, such as the allowed indexes. Creating a role that does not have search capabilities or searchable indexes would accomplish this. However, since the admin role (by default) has capabilities to edit these same capabilities you would need to disable that functionality. The capabilities that will minimally need disabling are:


Also, you would disable all allowed and searchable indexes:

srchIndexesAllowed = 
srchIndexesDefault = 

Both of these edits can be performed in authorize.conf or via the UI in the Access Control portion of the manager tool.

View solution in original post