Configure AR workspace permissions

Admins can provide users specific roles with read or write access for an asset or asset group.

Splunk Cloud Gateway comes with the ar_user and ar_admin roles. Provide Splunk AR users with the ar_user role, and provide Splunk AR admins with the ar_admin role, so that AR users have read access and AR admins have write access.

Splunk Cloud Gateway also comes with the the ar_write capability. If you provide a user the ar_write capability or the admin_all_objects capability in Settings > Access Controls > Users of Splunk Web, that user will have read and write access to all AR workspaces, regardless of what the AR workspace permission configurations are.

Prerequisites

Complete the following steps before configuring AR workspace permissions:

• Have admin roll access.
• Install Splunk Cloud Gateway on your Splunk Enterprise search head.
• Enable Splunk AR in the Configure tab of Splunk Cloud Gateway. See the Install and Administer Splunk Cloud Gateway manual.

Before configuring AR workspace permissions, provide users the appropriate roles and provide roles the appropriate capabilities in Splunk Web:

• Provide Splunk AR admins with the ar_write role.
• Provide Splunk AR users with the ar_user role.

To edit roles and capabilities, see Add and edit roles with Splunk Web.

Steps

1. In the Splunk AR tab of Splunk Cloud Gateway, click edit next to an AR workspace that you want to configure permissions for.
   You can configure permissions for an individual asset, or an asset group.
   
2. In the Read Access Roles field, enter the roles that you want to provide read access to.
   Leave this field blank to grant all users with the cloudgateway role read access.
   
3. In the Write Access Roles field, enter the roles that you want to provide write access to.
   Leave this field blank to grant only users with the ar_admin, sc_admin, or admin role write access.
   
4. Click Confirm.

You can also configure permissions when you register an asset.