What are the minimum set of capabilities to log in to Splunk and search an index?

[the_wolverine]

I want to create a standalone user role to access a single index for search only. I do not want to inherit any existing role.

What are the minimum capabilities required to do this?

[the_wolverine · Accepted solution]

It looks like these are the minimum capabilities.

get_metadata = enabled
rest_properties_get = enabled
search = enabled

[w531t4]

is this for web only, or api only?

[the_wolverine]

This is web and api. There is currently no distinction between the two.

[acharlieh]

It's been a while since I've looked into things... but are you asking for members of this role to execute searches via the Splunk Web or the API only ?