Hello
Is it possible to add role capability so the user will be able to see the list of all active users but without adding more capabilities ?
If not, is there other way to get such list with searching option so the user will be able to search a specific user from the list ?
Thanks
If its just a list of users they need access to, you can schedule a report to run as someone that has access to the user info (like an admin).
Then grant the users access to that report's results.
The report would be something like:
| rest splunk_server=local /services/authentication/users
| table title realname
There are two capabilities which might fit here
list_all_users
list_all_roles
Hey
those capabilities no longer exists in splunk cloud
Ahhh... Didn't notice it's the Cloud section. My bad 🙂