Dashboard panels: what's the proper use of the splunk admin_all_objects capability vs. read permission settings?

[kteng2024]

When I give admin_all_objects to a role, that role can also edit the permissions of the dashboards, but when I remove this capability, some of the dashboards are not working because of the field extraction and lookup, despite having global permissions. So, is there any way to remove the "edit permissions" by giving the admin_all_objects to a role?

[somesoni2]

Apart from scope being global, you need to ensure that your role has read permissions on those field extractions/lookups. Once you fix the permissions, you don't need admin_all_objects capability to be given, and still all dashboards works.

[DalJeanis]

Yes.

Admin_all_objects is giving the user the keys to the car, the combo to the safe, a book of blank checks, an unlimited congressional spending account, and a case of rum.