Role capabilities required to add a new search peer

[pbunce1]

I currently have Admin level access on my own Splunk instance and want to add a new search peer (another Splunk isntance) - the user account I have access to on the other search peer is default user acccess and am able to run searches etc.)

When trying to add the new seach peer I get this error:
Encountered the following error while trying to save: In handler 'distsearch-peer': Status 403 while sending public key to search peer https://MYSERVERXXX.com:8089: In handler 'certificates': You do not have permission to perform this operation (requires capability: edit_user).

I assume this relates to access issues on the external splunk instance (given that I have admin access on my own) - is it correct to require raised privs incuding edit_user on the external splunk instance just so that I can add it as a new search peer on my own instance?

Thanks

Phil

[dart · Accepted solution]

Essentially adding a search peer is setting up a trust between the search head and the peer, so you need permission to be able to do that.