How to create a Splunk User Account for only editing all User Accounts?

New Member

Hey Guys!

I want to be able to create a user account, that has only one capability (the edit_user), so that whenever someone forgets their password, they can log in to this user account and not be able to see or search for any data, but only be able to edit the other user accounts (if there is a way to only be able to edit their specific account that would be awesome). I tried creating a Splunk user account and added a role with only the edit_user but when I logged into that account and tried to go to the user access section to change a users account I got this page, which is displayed in the image. Any ideas on how to fix this?alt text

0 Karma


Hi qfulgham,
You can try and create a limited user role - inheritance from user and limit the data view by removing indexes from the Indexes box (bottom box) and add the edit_user capability. then have your edit_user inherent the new role.
Works for me on Windows 10 Splunk version 6.5.1
Hope it helps

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!