Security

"You do not have permission to spawn real-time searches"

matthewcanty
Communicator

Where do I find the settings to allow a user to have permission to "spawn" real-time searches?

EDIT:

What settings do I need to change. Can't see any specific "Allow real-time searches"...

1 Solution

yannK
Splunk Employee
Splunk Employee

as an admin in the manager > access control > roles

View solution in original post

yannK
Splunk Employee
Splunk Employee

as an admin in the manager > access control > roles

View solution in original post

yannK
Splunk Employee
Splunk Employee

thanks for the last part Drainy.

matthewcanty
Communicator

Ah yes I see it now.

Manager > Access Controls > Roles > role > Capabilities > Select rtsearch

Drainy
Champion

you need them to have the rtsearch capability. Have a read of http://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities

matthewcanty
Communicator

I got that far. What setting do I need to change?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!