Security

capability admin all objects

efaundez
Path Finder

good afternoon

   I have the following question, there are currently roles in our cluster that have the following restriction srchMaxTime = 3600, but it is validated that certain users are searching for more than 1 hour and I ask if this is due to the cability "admin all object".

any help is appreciated

Cheers

0 Karma

nickhills
Ultra Champion

admin_all_objects

Lets the user access and modify any object in the system regardless of any restrictions set in the objects. For example user objects, search jobs, reports, and knowledge objects. Lets the user bypass any ACL restrictions, much the way root access in a *nix environment does.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Security/Rolesandcapabilities

if you have admin_all_objects all restrictions can be disabled.
Only trusted admins should have that capability

If my comment helps, please give it a thumbs up!
0 Karma

efaundez
Path Finder

Good afternoon

   Thanks for the answer, but I have performed tests on the servers with a user who has admin_all_object and the ad-hoc searches are limited in the same way, for my example leave the parameter srchMaxTime = 60 and the query ended, but I am validating if the searches programmed are also limited by this parameter.

0 Karma

nickhills
Ultra Champion

Also - its worth noting that if someone has admin_all_objects, it means they can change their own capabilities.

If my comment helps, please give it a thumbs up!
0 Karma

efaundez
Path Finder

Of course, with respect to that point we will make the pertinent modifications, but the requirement that we have is how to limit that the programmed searches do not exceed 60 minutes of execution?

0 Karma

nickhills
Ultra Champion

Reports and searches can be configured to run with the role of either the user who created them, or the user who runs them.

If a user with higher capabilities creates a search, but is run by a user with lesser role, the search may be configured to run with the higher capabilities.

If my comment helps, please give it a thumbs up!
0 Karma