What Capabilities is needed to Create Identity Management for Data Enrichment in ES

[jimmyzhangau]

Hi,
When I wanted to create a new lookup in ES through ES->Configure->Data Enrichment->Identity Management, there's no "New" button, the role we are using is ess_admin, from the documentation, "edit_identitylookup" is the capability should be granted, but I've already include that capability into the role. Any other capabilities do we have to grant to the role?

Cheers,

[Robbie1194]

I'm not too sure about the specific roles you require but when I created my identity list in Splunk ES I followed the following steps:

http://docs.splunk.com/Documentation/ES/5.0.0/Admin/Configurenewassetoridentitylist

I was also ESS_admin when I done this so that role should be enough I would think.

If this doesn't help you then any further info on your problem might help in trying to assist you.

Cheers!