I am in need of creating a user account that has no access at all to the dashboards. The only purpose of the account is to run scheduled searches through a rest API. Does anyone know if its possible to create such an account?
Create an authentication token for the API user and give them only that. Without a password (which must be defined, but doesn't have to be disclosed), the user cannot log in to the UI.
--- If this reply helps you, Karma would be appreciated.
It’s best to use local splunk user for this even all other users are SAML or SSO users. User needs to have role (unless you can use only predefined reports which are run as owner) and if/when user has role in splunk he/she can always log in.
