edit_tcp_stream edit_upload_and_index input_file search were the needed capabilities to show the "Add Data" button under Settings in Splunk Cloud, specifically. I think the only ones you really do need though are "edit_upload_and_index" and "search" - specifying the indexes available at the role level did limit the shown indexes in the drop-down when going through the add data workflow.   ... View more

Hi @woodcock, do you know if this effort to re-architect Splunk you were referring to back in 2019 has been finished/released at all?  I'm interested in what the vision was to be back then.  Thank you! ... View more