To use the CLI command you need a Splunk login (not an operating system login) that has the Splunk admin role. How this nets out depends on some things - you can configure LDAP authentication (even for your forwarders) and let them centrally authenticate / authorize that way. Or, you can use the default admin account and whatever password you set for it. You could also add a Splunk user just for this purpose. Alternately, splunk add monitor will eventually end up changing an inputs.conf config file. You could configure filesystem permissions to allow others to access this file, and they could edit it as necessary to add new monitor inputs. ... View more