I was able to get this working by setting up a role with the following capabilities: edit_monitor - Required to make the "Add Data" option show up in the settings menu. indexes_edit - Required to make the users index name show up in the Indexes drop down when uploading the file. edit_tcp - Required to get the file to actually upload. Without this capability the file upload would hang. search - Required so the user can preview the uploaded file. This is the absolute minimum set of capabilities necessary to make file uploads through SplunkWeb work for a user. In addition though, I did have to make these changes as well: Add the users index to indexes.conf on the search head. Without this the index name would not appear in the Indexes drop down when trying to upload a file. The user must explicitly select the index name from the Indexes drop down or the file will not be put in to their index. Selecting "Default" for the index caused the file to be uploaded in to the "main" index even though the users default index was set to something else. I was not able to find any way to make "Default" point to the users default index when uploading files. Note that this was all done on Splunk 6.2, you mileage may vary on other Splunk versions. ... View more