Add and edit roles with Splunk Web

When you create users, you can assign roles that determine the level of access that users have to the Splunk platform and the tasks that they can perform. The platform comes with a set of default roles that you can use. You can also create your own custom roles.

Roles contain one or more capabilities that provide access to specific parts of the Splunk platform. A user that has a role assigned to them receives all of the capabilities that are associated with the role. Roles can inherit capabilities from other roles, and you can manage that inheritance in Splunk Web.

While you can have any role inherit from any other role, custom roles that inherit from the admin or power users roles do not automatically inherit administrator-level access to the instance.

• For information about roles and how capabilities and permissions are inherited, see About configuring role-based user access.
• For information about granting management access to custom roles, see Add access controls to custom roles.
• For more information about role inheritance, see Role inheritance in the About role-based user access topic.
• For more information about how capabilities work, as well as the full list of capabilities, see About defining roles with capabilities.

Add or edit a role

Create or edit roles for your Splunk platform instance on the Roles page in Settings.

1. Click Settings > Access Controls.
2. On the Access controls page, click Roles.
3. Click New to create a new role, or click an existing role to edit it.
4. Enter a name for your role.
   

   Role names must use lowercase characters only. They cannot contain spaces, colons, or forward slashes. You cannot edit the names of existing roles.

5. (Optional) In the Default app dropdown in the Resources tab, select the default Splunk app that appears when a user that holds this role logs in.
6. (Optional) In the Restrict search terms field in the Resources tab, you can restrict the scope of the searches that users with the role can run. You can restrict the search terms they can use, set limits on search time, and set both user-level and role-level concurrent search limits.
   

   Search term restrictions offer limited security. A user can override some search term restrictions if they create a calculated field that references a field name listed here as a restricted term.

7. (Optional) In the Inheritance tab, identify other roles from which your role can inherit properties and capabilities. A user assigned to multiple roles inherits properties from the role with the broadest permissions.
1. Click Inheritance to display the contents of the Inheritance tab.
2. (Optional) In the Role Name field, type in a string to display role names that contain the string.
3. Click the checkbox next to the roles from which you want this role to inherit permissions.
4. Click Save.
8. (Optional) In the Capabilities tab, choose any individual capabilities that you want to provide to this role.
1. Click Capabilities to display the contents of the Capabilities tab.
2. (Optional) In the Capability Name field, type in a string to display capability names that contain the string.
3. Click the checkbox next to the capabilities that you want to assign to this role.
4. Click Save.

   Capabilities that have been inherited from other roles appear as grayed out and selected. You cannot deselect capabilities that come with inherited roles. You must save the role before you can see its inherited capabilities.

9. (Optional) Use the Indexes tab to choose the indexes that the role can search, and which ones it should search by default. You can specify both event and metric indexes. If a user with the role runs a metrics search without a specified index, the search includes results from the default metrics indexes that you assign to the role.
   1. Click Indexes to display the contents of the Indexes tab.
   2. (Optional) In the Index Name field, type in a string to display index names that begin with that string.
   3. Click the Included checkbox for an index to allow searches and include search results from that index for this role.
   4. Click the Default and Included checkboxes for an index to include search results from that index when a user that holds this role does not specify an index in their search.

      Indexes from inherited roles appear as grayed out and selected. You cannot deselect indexes that come with inherited roles.

   5. Click Save.
10. Click Save.

Updates to the search term restrictions for a role do not take effect until you restart your Splunk platform instance. If you do not restart, the instance cannot enforce your search term restriction updates.

For more information about restarting the Splunk platform, see Start and stop Splunk Enterprise in the Admin Manual.

Search filter format

The Restrict search terms field can include any of the following search terms:

• source::
• host::
• index::
• sourcetype::
• eventtype= or eventtype::
• Search fields

When you specify search term restrictions, use the key::value syntax, when possible, to restrict search terms to indexed fields. Normal field values can be overwritten with user knowledge objects. The key::value syntax only applies to indexed fields.

You can use wildcards. Use OR to allow multiple terms, or AND to make the filter more restrictive.

The search terms cannot include any of the following:

• Saved searches
• Time operators
• Regular expressions
• Any fields or modifiers that you can override from the Splunk Web search bar

Special syntax rules for search filters of metric data

Search filters that limit user access to metric data do not follow the same rules as search filters for event data.

Search filters for metric data must use the key=value comparison syntax. Metrics search cannot utilize the key::value syntax.

Search filters for metric data can filter dimensions and metric names. For example, you can set up search filters for dimensions like os=linux or server=athens and metric names like metric_name=mem.free.