Splunk Enterprise Security

In Splunk Enterprise Security, how do you create a user role with ready-only access?


Is there any way to create a user role with read-only access to a specific set of indexes?

0 Karma

Super Champion

Have a look at this, might be useful to you:

let me know if this helps!

0 Karma


You can create a role with only read access. You can go to settings >> access control >> roles
You can know more from the following link

0 Karma

Ultra Champion

Interesting thing as Splunk roles are designed for read access, not for write access and each role has read access to a set of indexes.

If we look at About users and roles

It defines the user role as -

-- this role can create and edit its own saved searches, run searches, edit its own preferences, create and edit event types, and other similar tasks.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...