Getting Data In

How can I use REST endpoints (or gui) to upload a file to role-restricted indexes?

cfergus
Path Finder

Our Splunk environment has multiple indexes, with role restrictions on index access.

I want to allow users to upload files in a fashion similar to Manager > Data Inputs > Files & Directories > Add New using the 'upload a local file' option.

They should only be able to upload local files (no Splunk server files should be input), and only to indexes they are allowed access to.

The authorization capabilities doesn't seem to allow for only this.

I'd be happy with a REST or UI based solution to this conundrum.

Is this possible?

Tags (2)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Unfortunately not. Adding inputs requires the "edit_monitor" capability, which is independent of role-restricted indexes.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

Unfortunately not. Adding inputs requires the "edit_monitor" capability, which is independent of role-restricted indexes.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...