Splunk Enterprise

Is there a way to be able to view users without having Edit User access?


We have a situation where we need to have General day to day admin Role and an Elevated admin role.

Day to Day will allow for most things, but should not allow for creation / deletion of local accounts.

Setting this up is easy, only issues is, even though I have admin all objects, I'm not able to see any other users details - i.e. I can't see any other users when I try to re-assign objects, I can't see any other users details when running rest calls - to see how they are set-up etc.

Just wondering if anyone else has run into anything like this and managed to figure out a way to work around it?

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...