Splunk Search

Dashboard panels: what's the proper use of the splunk admin_all_objects capability vs. read permission settings?

Path Finder

When I give admin_all_objects to a role, that role can also edit the permissions of the dashboards, but when I remove this capability, some of the dashboards are not working because of the field extraction and lookup, despite having global permissions. So, is there any way to remove the "edit permissions" by giving the admin_all_objects to a role?

0 Karma

Revered Legend

Apart from scope being global, you need to ensure that your role has read permissions on those field extractions/lookups. Once you fix the permissions, you don't need admin_all_objects capability to be given, and still all dashboards works.

0 Karma



Admin_all_objects is giving the user the keys to the car, the combo to the safe, a book of blank checks, an unlimited congressional spending account, and a case of rum.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!