What are the capabilities required for enabling/disabling maintenance mode?

[splkjk]

Hello Team, What capabilities are required for enabling and disabling the maintenance mode. Based on the following link https://community.splunk.com/t5/Security/Capabilities-needed-for-a-service-account-to-enable-Mainten... , i did provide the following capability edit_indexer_cluster ,  but no breakthrough.

[SanjayReddy · Accepted solution]

Hi @splkjk 

are you trying to enable/disbale maintenace mode from Clustermaster UI?. we dont have option to enable /disable from UI 

 after adding capability edit_indexer_cluster try to execute follwing commands from CLI 

$SPLUNK_HOME$/bin

./splunk show maintenance-mode -auth <splunkusername>:<password>

./splunk enable maintenance-mode <splunkusername>:<password>

./splunk disable maintenance-mode <splunkusername>:<password>

[splkjk]

Hi @SanjayReddy , Thanks for the inputs...

nope, I'm not using GUI for enabling or disabling maintenance mode.

we did add edit_indexer_cluster , but when i try to execute enable maintenance with below error

******:~ $ /opt/splunk/bin/splunk enable maintenance-mode
Warning: In maintenance mode, the cluster manager will not attempt to replace any missing replicated or searchable bucket copies. This mode should be enabled only while performing maintenance on peers. Do you want to continue? [y/n]: y
Your session is invalid. Please login.
Splunk username: testuser
Password:
Login failed
call not properly authenticated

below are the capability added for that role

[role_supp_team]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
edit_indexer_cluster = enabled
importRoles = user
srchMaxTime = 8640000

[SanjayReddy]

Hi @splkjk 

it seems login failed due to  there was issue with username/password, 

please try to use correct username/password, or reset the creds and try again

I am able to to enable/disable maintenance mode from same configuration you mentioned,

have you added role_supp_team to test user under users settings

[splkjk]

Hi @SanjayReddy , i am able to login to splunk via GUI , by providing the same id and password. But when I try to execute the enable the maintenance mode on Cluster master, it gets failed  and i do have the same role that is mentioned in your screenshot.

I am still getting the same error

Your session is invalid. Please login.
Splunk username: testuser
Password:
Login failed
call not properly authenticated 

[splkjk]

Hello @SanjayReddy  tried crossing 1 hurdle..

so, our environment is a cluster environment with few search heads and few indexers, a Cluster master and Deployer. so i created user on search head and that was the reason i was able to login to splunk GUI, but not able to enable the maintenance mode on CM. so i have created the same role and user on cluster master and tried executing the maintenance mode , it did get executed, but now with different error, i have provided  edit_indexer_cluster capability, still getting the error, not sure why...., any insights

Your session is invalid. Please login.
Splunk username: testuser
Password:
You (user=testuser) do not have permission to perform this operation (requires capability: edit_indexer_cluster).