Splunk Search

Dashboard panels: what's the proper use of the splunk admin_all_objects capability vs. read permission settings?

kteng2024
Path Finder

When I give admin_all_objects to a role, that role can also edit the permissions of the dashboards, but when I remove this capability, some of the dashboards are not working because of the field extraction and lookup, despite having global permissions. So, is there any way to remove the "edit permissions" by giving the admin_all_objects to a role?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Apart from scope being global, you need to ensure that your role has read permissions on those field extractions/lookups. Once you fix the permissions, you don't need admin_all_objects capability to be given, and still all dashboards works.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Yes.

Admin_all_objects is giving the user the keys to the car, the combo to the safe, a book of blank checks, an unlimited congressional spending account, and a case of rum.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...