Splunk Enterprise Security: What role or capability is needed to enable the investigations functionality for users?

[szabados]

Some users reported that the investigations functionality is not available for them in the Enterprise Security app. What role/capability should I assign to them?

[smoir_splunk]

To create investigations, a user must be an ess_admin or have the edit_timeline capability. See
http://docs.splunk.com/Documentation/ES/4.1.1/Install/ConfigureUsersRoles to see how to add the capability.

If they can see investigations but can't view specific investigations, they would need to be added as a collaborator on that investigation.

[tskinner_splunk]

should not be assigning ess_admin role to users. It is a container role which is used just to give additional capabilities and inherited by admin (or sc_admin in splunk cloud) to be used for ES installation and upgrade tasks. It contains no ACLs

https://docs.splunk.com/Documentation/ES/latest/Install/ConfigureUsersRoles