Alerting

Role Capabilities for splunkd-log

eekanem
New Member

Hi, what is the minimum capability without admin_for_all for a non-admin user to access splunkd-log object?

0 Karma

rupkumar4sec
Path Finder

I am not sure what you mean by splunkd-log object but if you are trying to access splunkd internal logs, you just need to add  those internal indexes or "_*"  to srchIndexesAllowed . 

0 Karma

eekanem
New Member

That does not seem to be enough for me. I noticed that with the power user I could access the splunk internal logs so I added the capabilities to my role but it still does not work.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...