Hi,
When I wanted to create a new lookup in ES through ES->Configure->Data Enrichment->Identity Management, there's no "New" button, the role we are using is ess_admin, from the documentation, "edit_identitylookup" is the capability should be granted, but I've already include that capability into the role. Any other capabilities do we have to grant to the role?
Cheers,
I'm not too sure about the specific roles you require but when I created my identity list in Splunk ES I followed the following steps:
http://docs.splunk.com/Documentation/ES/5.0.0/Admin/Configurenewassetoridentitylist
I was also ESS_admin when I done this so that role should be enough I would think.
If this doesn't help you then any further info on your problem might help in trying to assist you.
Cheers!