Splunk Enterprise Security

Splunk for Enterprise Security: Is it possible to allow non-admin users to edit and save Assets and identities lists manually?

btran
Explorer

I have a non-admin user "testuser" added to a non-admin "testrole"
I give testrole capabilities of edit_identitylookup, edit_lookups in capabilities.
I log in to my testuser, and I edit identity lookup file, but cannot save.
I also gave "write" permissions to testrole in the Asset and identities files.

Can a non-admin role edit the Identities and Asset files?

0 Karma

ekost
Splunk Employee
Splunk Employee

The list of custom capabilities in ES and the settings that must be changed are listed in the documentation here. Look for the "Manage Lookups" section.

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...