splunk access delegation/roles

[jbanda]

I'm trying to set up a role in one of our splunk servers (running 4.1.5 on a 64 bit redhat linux 5 machine). What I really want to do is create a role that has almost all admin capabilities except the ability to delete data and modify roles. This role should be able to create indexes and start/stop splunk.

I see that there are some capabilities that seem to grant this (like restart_splunkd). However, while I can these capabilities to a role, I noticed that all roles except the built-in "admin" role are missing certain sections in the manager section. Logging in with a user that has the admin role, I see the following on the right column under "System configurations"

-System settings
-Server controls
-License
-Data inputs
-Forwarding and receiving
-Indexes
-Access controls
-Distributed search
-Deployment
-User options

However, if I grant a role the ability to restart splunk, and place a user in that role, logging into the manager section with that user only shows one item on the left under "System Configurations", which is the "User options" section.

I've even gone as far as cloning the "admin" role and trying to log in with that newly (and unmodified after the clone) role, and I still do not see the full list of options in the Manager under "System configurations".

So, since I figure I'm missing something very obvious, can someone either point me in the right direction, or confirm that what i'm trying to do is just not possible? -Joseph

[wollinet]

Just tried the same without success (version 4.1.7). Have you considered opening a case ?

I found a solution that might help. You can overwrite the admin role in local\autorize.conf and reduce the number of capabilities. The you can define a new "myadmin" role with all capabilities. But I don't know, how that works out with updates.