Splunk IT Service Intelligence

I created a new role in ITSI and they cannot view service definitions/ thresholds/KPI's

amckinnie_splun
Splunk Employee
Splunk Employee

I want my users to only have read access to service definitions and thresholds. I created a new role with all of the read access capabilities in ITSI. Users with the new role should be able to see various items and not edit them. However, when a user tries to view service definitions and thresholds, the page does not load. 

0 Karma
1 Solution

amckinnie_splun
Splunk Employee
Splunk Employee

To create a custom role in ITSI you have to perform 4 steps. 

1. Assign the role proper capabilities

2. Grant the role access to ITSI indexes

3. Assign the role proper view-level access

4.Assign the role KV store collection level access

The step most people skip is to assign proper view level access. To do this, navigate to Settings >> all configurations OR Settings >> User interface>>Views. Here you need to grant view access for your newly created role. If you are not sure which view the user needs access to? Pay attention to the URL. Navigate to the area that the role cannot access and look at the URL, this will tell you which view you should update. 

Ex URL: splunkcloud.com/en-US/app/itsi/entity_detail.......

Navigate to Settings >> User Interface >> Views >> search for entity. You will see the item named entity_detail. Modify the permissions and allow the new role to have read rights. This will allow the new role to access this view. 

View solution in original post

0 Karma

amckinnie_splun
Splunk Employee
Splunk Employee

To create a custom role in ITSI you have to perform 4 steps. 

1. Assign the role proper capabilities

2. Grant the role access to ITSI indexes

3. Assign the role proper view-level access

4.Assign the role KV store collection level access

The step most people skip is to assign proper view level access. To do this, navigate to Settings >> all configurations OR Settings >> User interface>>Views. Here you need to grant view access for your newly created role. If you are not sure which view the user needs access to? Pay attention to the URL. Navigate to the area that the role cannot access and look at the URL, this will tell you which view you should update. 

Ex URL: splunkcloud.com/en-US/app/itsi/entity_detail.......

Navigate to Settings >> User Interface >> Views >> search for entity. You will see the item named entity_detail. Modify the permissions and allow the new role to have read rights. This will allow the new role to access this view. 

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...