Securing Splunk Enterprise

Set up Splunk authentication

Splunk authentication allows you to easily set up users within your system. Splunk authentication always takes precedence over any external authentication systems. This is the order in which users are authenticated:

1. Splunk authentication.

2. LDAP or Scripted authentication (if enabled). For more information, see "Set up user authentication with LDAP" and "Set up user authentication with external systems."

Note: LDAP and scripted authentication cannot be used together.

You can create new users and assign those users to roles with a role-based access control system in two ways:

• Use Splunk Web to create users and assign roles. For more information see "Configure users with Splunk Web."
• Use the CLI to create users and then assign them to roles with Splunk Web. For more information see "Configure users with the CLI."

Important naming guidelines when creating users and roles

Usernames stored in native authentication cannot contain spaces, colons, or forward slashes. Names are case-insensitive, for example: "Jacque", "jacque", "JacQue" are all the same to Splunk authentication.

Role names must use lowercase characters only. They cannot contain spaces, colons, or forward slashes.