capability admin all objects

[efaundez]

good afternoon

   I have the following question, there are currently roles in our cluster that have the following restriction srchMaxTime = 3600, but it is validated that certain users are searching for more than 1 hour and I ask if this is due to the cability "admin all object".

any help is appreciated

Cheers

[nickhills]

admin_all_objects

Lets the user access and modify any object in the system regardless of any restrictions set in the objects. For example user objects, search jobs, reports, and knowledge objects. Lets the user bypass any ACL restrictions, much the way root access in a *nix environment does.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Security/Rolesandcapabilities

if you have admin_all_objects all restrictions can be disabled.
Only trusted admins should have that capability

[efaundez]

Good afternoon

   Thanks for the answer, but I have performed tests on the servers with a user who has admin_all_object and the ad-hoc searches are limited in the same way, for my example leave the parameter srchMaxTime = 60 and the query ended, but I am validating if the searches programmed are also limited by this parameter.

[nickhills]

Also - its worth noting that if someone has admin_all_objects, it means they can change their own capabilities.

[efaundez]

Of course, with respect to that point we will make the pertinent modifications, but the requirement that we have is how to limit that the programmed searches do not exceed 60 minutes of execution?

[nickhills]

Reports and searches can be configured to run with the role of either the user who created them, or the user who runs them.

If a user with higher capabilities creates a search, but is run by a user with lesser role, the search may be configured to run with the higher capabilities.