Capability to upload data files via the gui for a user?

[stekilburn]

I need to assign a capability to an existing Splunk user, so that they can upload files to their own index themselves via the Splunk gui.
They currently have no view of the 'DATA INPUTS' parameter on the gui as they have basic search capability restricted to their own data in their own index.
I have tried adding the capability of 'INPUT_FILE' & 'LIST_INPUTS' but this doesn't work.
Has anyone done this already?
Thanks

[curtisb1024]

I was able to get this working by setting up a role with the following capabilities:

edit_monitor - Required to make the "Add Data" option show up in the settings menu.
indexes_edit - Required to make the users index name show up in the Indexes drop down when uploading the file.
edit_tcp - Required to get the file to actually upload. Without this capability the file upload would hang.
search - Required so the user can preview the uploaded file.

This is the absolute minimum set of capabilities necessary to make file uploads through SplunkWeb work for a user. In addition though, I did have to make these changes as well:

1. Add the users index to indexes.conf on the search head. Without this the index name would not appear in the Indexes drop down when trying to upload a file.
2. The user must explicitly select the index name from the Indexes drop down or the file will not be put in to their index. Selecting "Default" for the index caused the file to be uploaded in to the "main" index even though the users default index was set to something else. I was not able to find any way to make "Default" point to the users default index when uploading files.

Note that this was all done on Splunk 6.2, you mileage may vary on other Splunk versions.

[somesoni2]

Try adding "edit_monitor" capabilities.

[starcher]

A better solution would be to use the Universal forwarder to monitor a drop folder on a machine they can access. They can just drop data files there as needed and have it get pulled in and indexed.
Setting data inputs up including one shot uploads is more an administrative function and dangerous to give end users.