Alerting

Role Capabilities for splunkd-log

eekanem
New Member

Hi, what is the minimum capability without admin_for_all for a non-admin user to access splunkd-log object?

Labels (1)
0 Karma

rupkumar4sec
Path Finder

I am not sure what you mean by splunkd-log object but if you are trying to access splunkd internal logs, you just need to add  those internal indexes or "_*"  to srchIndexesAllowed . 

0 Karma

eekanem
New Member

That does not seem to be enough for me. I noticed that with the power user I could access the splunk internal logs so I added the capabilities to my role but it still does not work.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!