Splunk® Enterprise

Securing Splunk Enterprise

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

About defining roles with capabilities

When you create a user in Splunk Web you assign that user to one role. See About role-based user access for more information.

Each role contains a set of capabilities. You can add or edit capabilities for new, existing, and default roles. For example, you might give a role the capability to add inputs or edit saved searches.

To add or change the capabilties to a role in Splunk Web, see Add and edit roles with Splunk Web. To create roles by editing authorize.conf, see Add and edit roles with authorize.conf.

List of capabilities

This list shows the capabilities that you can add to any role, and whether any capabilities are assigned by default to the User, Power, or Admin roles.

Capabilities are subject to change. For the most up-to-date list of capabilities, see authorize.conf.

For the most up-to-date list of capabilities assigned to a role, see the "Imported Capabilities" text box in the "Create a role" page.

Capability name What it lets you do User Power Admin
accelerate_datamodel Enable or disable acceleration for data models. Set acceleration to true to enable automatic acceleration of this data model. Additional space is required depending on the number of events, fields, and distinct field values in the data. See the Knowledge Manager Manual for more information. X
accelerate_search Lets the user enable or disable acceleration for reports. The user must also have the schedule_search capability assigned. Works for searches that use transforming commands. See the Knowledge Manager Manual for more information. X X X
admin_all_objects Lets the user access and modify any object in the system regardless of any restrictions set in the objects. For example user objects, search jobs, reports, and knowledge objects. Allows the user to bypasses any ACL restrictions, much the way root access in a *nix environment does. X
change_authentication Lets the user change authentication settings and reload authentication. See the Securing Splunk Enterprise Manual for more about authentication. X
change_own_password Lets the user change their own password. X X X
delete_by_keyword Lets the user use the "delete" operator. The "delete" command marks all of the events returned by the search as deleted. This masks the data from showing up in search results but does not actually delete the raw data on disk. See the Search Manual for more information.
dispatch_rest_to_indexers Lets a user dispatch the REST search command to indexers. X
edit_deployment_client Lets the user change deployment client settings. See the Managing Indexers and Clusters of Indexers Manual for more about the deployment client. X
edit_deployment_server Lets the user change deployment server settings. User can change or create remote inputs that are pushed to the forwarders and other deployment clients. See the Managing Indexers and Clusters of Indexers manual for more about the deployment server. X
edit_dist_peer Lets the user add and edit peers for distributed search. See the Managing Indexers and Clusters of Indexers Manual for more information. X
edit_encryption_key_provider Lets the user view and edit key provider properties when they use Server-Side Encryption (SSE) for a remote storage volume. X
edit_forwarders Lets the user change forwarder settings, including settings for SSL, backoff schemes, etc. Also used by TCP and Syslog output admin handlers. X
edit_httpauths Lets the user edit and end user sessions through the httpauth-tokens endpoint. X
edit_indexer_cluster Lets the user edit indexer clusters. See the Managing Indexers and Clusters of Indexers Manual for more about indexers. X
edit_indexerdiscovery Lets the user edit settings for indexer discovery, including settings for master_uri, pass4SymmKey, and so on. Used by Indexer Discovery admin handlers. X
edit_input_defaults Lets the user use the server settings endpoint to change default hostnames for input data. X
edit_monitor Lets the user add inputs and edit settings for monitoring files. Also used by the standard inputs endpoint and the one-shot input endpoint. X
edit_roles Lets the user edit roles and change user/role mappings. Used by both the user and role endpoint. X
edit_roles_grantable Lets the user edit roles and change user/role mappings for a limited set of roles. Can assign any role to other users. To limit this ability, configure grantableRoles in authorize.conf. For example: grantableRoles = role1;role2;role3 X
edit_scripted Lets the user create and edit scripted inputs. X
edit_search_head_clustering Lets the user edit search head clustering settings. X
edit_search_schedule_priority Lets the user assign a search a higher-than-normal schedule priority. For information about the search scheduler, see the Knowledge Manager Manual. X
edit_search_schedule_window Lets the user assign schedule windows to scheduled reports. Requires the schedule_search capability. For more about the search scheduler, see the Knowledge Manager Manual. X X
edit_search_scheduler Lets the user enable and disable the search scheduler. See the Knowledge Manager Manual. X
edit_search_server Lets the user edit general distributed search settings like timeouts, heartbeats, and blacklists. X
edit_server Lets the user edit general server settings like server name, log levels, etc. X
edit_server_crl Lets the user edit general server settings like server name, log levels, etc. Inherits the ability to read general server and introspection settings. X
edit_sourcetypes Lets the user edit sourcetypes. See the Knowledge Manager manual for more information about sourcetypes. X X
edit_splunktcp Lets the user change settings for receiving TCP inputs from another Splunk instance. X
edit_splunktcp_ssl Lets the user view or edit any SSL-specific settings for Splunk TCP input. X
edit_splunktcp_token Lets the user edit the Splunktcp token. X
edit_tcp Lets the user change settings for receiving general TCP inputs. X
edit_tcp_token Lets the user change TCP tokens. This is an admin capability and should only be assigned to system administrators. X
edit_telemetry_settings Opt in or out of product instrumentation. See Share data in Splunk Enterprise in the Admin Manual. X
edit_token_http Lets the user create, edit, display, and remove settings for HTTP token input. Also enables the HTTP Event Collector feature. X
edit_udp Lets the user change settings for UDP inputs. X
edit_user Lets the user create, edit, or remove users. A role with the edit_user capability can assign any role to other users. To limit this ability, configure grantableRoles in authorize.conf. For example: grantableRoles = role1;role2;role3. Also lets a user manage certificates for distributed search. X
edit_view_html Lets the user create, edit, or modify HTML-based views. X
edit_web_settings Lets the user change settings for web.conf through the system settings endpoint. X
embed_report Lets the user embed reports and disable embedding for embedded reports. X X
export_results_is_visible Lets the user display or hide the Export Results button in Splunk Web. The default value is to display the button. X X X
get_diag Lets the user get a remote diag from a Splunk instance using the /streams/diag endpoint. X
get_metadata Lets the user use the "metadata" search processor. X X X
get_typeahead Lets the user use typeahead in the endpoint and the typeahead search field. X X X
indexes_edit Lets the user change any index settings such as file size and memory limits. X
input_file Lets the user add a file as an input through inputcsv (except for dispatch=t mode) and inputlookup. X X X
license_edit Lets the user edit the license. X
license_tab Lets the user access and change the license. This attribute is deprecated. X
license_view_warnings Lets the user see a warning message when they are exceeding data limits or reaching the expiration date of their license. These warnings appear on the system banner. X
list_accelerate_search Lets the user view accelerated reports. User cannot accelerate reports. X
list_deployment_client Lets the user view deployment client settings. X
list_deployment_server View deployment server settings. X
list_forwarders Lets a user list and view settings for data forwarding. Can be used by TCP and Syslog output admin handlers. X
list_httpauths Lets the user view user sessions through the httpauth-tokens endpoint. X
list_indexer_cluster Lets the user view the list of indexer clusters as well as indexer cluster objects such as buckets, peers, etc. X
list_indexerdiscovery Lets the user view settings for indexer discovery. Also used by indexer discovery handlers. X
list_inputs Lets the user view lists of various inputs, including input from files, TCP, UDP, scripts, etc. X X X
list_introspection Lets the user read introspection settings and statistics for indexers, search, processors, queues, etc. X
list_metrics_catalog Lets the user query for lists of metrics catalog information such as metric names, dimensions, and dimension values. X X X
list_search_head_clustering Lets the user list and view search head clustering objects like artifacts, delegated jobs, members, captain, etc. X
list_search_scheduler Lets the user view lists of search scheduler jobs. X
list_settings Lets the user list and view server and introspection settings such as the server name, log levels, etc. X
list_storage_passwords Lets the user list and view the /storage/passwords endpoint, lets the user perform GETs. The admin_all_objects capability must added to the role for the user to perform POSTs to the /storage/passwords endpoint. X
output_file Lets the user create file outputs, including outputcsv (except for dispatch=t mode) and outputlookup. X X X
pattern_detect Lets the user see and use the Patterns tab in the Search view. X X X
request_remote_tok Lets the user obtain a remote authentication token, which lets the user perform some distributed peer management and bundle replication and distribute searches to old 4.0.x Splunk instances. X X X
rest_apps_management Lets the user edit settings for entries and categories in the python remote apps handler. See restmap.conf for more information. X
rest_apps_view Lets the user list and view various properties in the Python remote apps handler. See restmap.conf for more information. X X X
rest_properties_get Lets the user get information from the services/properties endpoint. X X X
rest_properties_set Lets the user edit the services/properties endpoint. X X X
restart_splunkd Lets the user restart Splunk Enterprise through the server control handler. X
rtsearch Lets the user run real-time searches. X X
run_debug_commands Lets the user run debug commands. For example "Summarize". X
run_multi_phased_searches Lets the user run searches with the redistribute command, which invokes parallel reduce search processing in distributed search environments. This capability is not assigned to any role by default.
schedule_search Lets the user schedule saved searches, create and update alerts, and review triggered alert information. X X
search Lets the user run a search. See the Search Manual for more information. X X X
search_process_config_refresh Lets the user use the "refresh search-process-config" CLI command to manually flush idle search processes. X X
srchFilter Lets the user manage search filters. See the Search Manual for more information. X
srchIndexesAllowed Lets the user run search indexes. See the Search Manual for more information. X
srchIndexesDefault Lets the user set default search indexes. X
srchJobsQuota Lets the user set search job quotas. X
srchMaxTime Lets the user set the maximum time for a search. X
use_file_operator Lets the user use the "file" search operator. The "file" search operator is deprecated. X
web_debug Lets the user debug Web files. X

Windows-specific capabilities

If you are running Splunk Enterprise on Windows, additional capabilities are provided to facilitate monitoring.

Capability name What it lets you do
edit_modinput_admon Edit modular inputs in admon.conf.
edit_modinput_perfmon Edit modular inputs in perfmon.conf.
edit_modinput_winhostmon Add and edit inputs for monitoring Windows host data
edit_modinput_winnetmon Add and edit inputs for monitoring Windows network data.
edit_modinput_winprintmon Required to add and edit inputs for monitoring Windows printer data.
edit_win_admon (Deprecated)
edit_win_eventlogs Edit windows eventlogs.
edit_win_perfmon (Deprecated)
edit_win_regmon (Deprecated)
edit_win_wmiconf Edit wmi.conf.
list_pdfserver View PDF server files
list_win_localavailablelogs List all local Windows event logs.
srchTimeWin Set search time limits.
write_pdfserver Write to PDF server files.
PREVIOUS
About configuring role-based user access
  NEXT
Add and edit roles with Splunk Web

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters