Splunk Enterprise Security

Splunk for Enterprise Security: Is it possible to allow non-admin users to edit and save Assets and identities lists manually?


I have a non-admin user "testuser" added to a non-admin "testrole"
I give testrole capabilities of edit_identitylookup, edit_lookups in capabilities.
I log in to my testuser, and I edit identity lookup file, but cannot save.
I also gave "write" permissions to testrole in the Asset and identities files.

Can a non-admin role edit the Identities and Asset files?

0 Karma

Splunk Employee
Splunk Employee

The list of custom capabilities in ES and the settings that must be changed are listed in the documentation here. Look for the "Manage Lookups" section.

0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...