Splunk Search

Dashboard panels: what's the proper use of the splunk admin_all_objects capability vs. read permission settings?

kteng2024
Path Finder

When I give admin_all_objects to a role, that role can also edit the permissions of the dashboards, but when I remove this capability, some of the dashboards are not working because of the field extraction and lookup, despite having global permissions. So, is there any way to remove the "edit permissions" by giving the admin_all_objects to a role?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Apart from scope being global, you need to ensure that your role has read permissions on those field extractions/lookups. Once you fix the permissions, you don't need admin_all_objects capability to be given, and still all dashboards works.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Yes.

Admin_all_objects is giving the user the keys to the car, the combo to the safe, a book of blank checks, an unlimited congressional spending account, and a case of rum.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...