The role capabilities' privileges

[Jack90]

Hello,

I am managing Splunk roles. I want to adjust capabilities to roles, but unfortunately for few of them I did not find what exactly they do.  Searching did not give me results or the results were not satisfying.

If you have some extract with all capabilities and their description, please advise me what exactly following capabilities do (screenshot attached)

[gcusello]

Hi @Jack90 ,

about user features I usually copy the same features of User role, but without inheritance to avoid that the new role has the same indexes access grants:you have to amnually enable the same features or (easier) you can clone theUser role, changing the indexes access grants.

Ciao.

Giuseppe

[Jack90]

Hi Gcusello, 

thank you for quick reply.

OK I understand, but I couldn't find at the Splunk documentation the information what that capabilities does- I am not sure if "user" role should be granted with them, or only "admin" role.

BR

J

[gcusello]

Hi @Jack90 ,

it depends on what then new role has to do.

Anyway, surely not admin role, eventually power user.

Ciao.

Giuseppe

[Jack90]

Hi,

but do you mean all 13 capabilities for power user?

I am trying to find what they actually do, to determinate if they should be user/power/admin. 

BR

J

[gcusello]

Hi @Jack90 ,

this is exactly what I meant:

• see if there's a role to use as starting point,
• then clone it (don't use inheritance!) c
• and eventally modify it before saving.

Ciao.

Giuseppe