Hi,
From authorize.conf specific
srchIndexesDefault = <string>
* Semicolon delimited list of indexes to search when no index is specified
* These indexes can be wildcarded, with the e...
When setting up a custom search command, is it still necessary to setup authorize.conf entries like this in Splunk 4.1?
[capability::run_script_dothething]
[role_Admin]
r...
I wonder if there is a limit on the number of indexes specified in srchIndexesAllowed of authorize.conf . We currently have 80 indexes for one customer and the customer can't search some of t...
I'm trying to configure a search Time Window for my Splunk roles. I've read the documentation but can't find instruction on what to set for the srchTimeWin attribute. The spec file indicates:
sr...
...LI, but this has not restored my previous admin privileges.
C:\Program Files\Splunk\etc\system\local\authorize.conf as follows to reset:
(a cut and copy from \default\authorize.conf)
[r...
Can an element of a role in authorize.conf be scoped for a particular app?
I have a local app where I would like to give "admin_all_objects" to all power users, but restrict that capability to o...
I found that there were two different authorize.conf files in different locations in our Splunk environment.
So I wanted to know if we have only one authorize.conf or are there multiple files?
On the deployer server we have the authorize.conf under /opt/splunk/etc/shcluster/apps/key_all_authentication/local . On the SH it ends up at /opt/splunk/etc/apps/key_all_authentication/default ....
What is the difference between the "srchJobsQuota" and the "cumulativeSrchJobsQuota" setting in the authorize.conf role stanzas? Should one or both be used to set the search quota for the role?
T...
I have index1, index2, and index 3. I want role_user to have access to all three within a specific app. Is there a way to do this? In $SPLUNK_HOME/etc/system/local my authorize.conf has s...