All Apps and Add-ons

How do I create the winfra-admin role?

rmanni
New Member

I am in the midst of deploying the Windows apps to monitor our AD environment, when I go to setup the Infrastructure app on our search head, I get the following error:

Users and/or groups configured with the winfra-admin user role:
No users or groups with winfra-admin user role detected.
Assign the winfra-admin user role via Splunk Settings >> Access Controls

However, I do not see a winfra-admin role when I go to assign that to a user/group? So is there a specific method to create this role given that it was not created when the app was deployed?

0 Karma
1 Solution

jcrabb_splunk
Splunk Employee
Splunk Employee

Referencing this doc for the Windows Infrastructure app, it explains where different components are to be installed:

For the Search Head you will see it requires "Splunk App for Windows Infrastructure". In the base app, under default, there is a authorize.conf with the new role. Did you deploy the app to the Search Head? If so, when you browse to the $SPLUNK_HOME/etc/apps/splunk_app_windows_infrastructure/default/ directory, do you see an authorize.conf file?

Jacob
Sr. Technical Support Engineer

View solution in original post

jcrabb_splunk
Splunk Employee
Splunk Employee

Referencing this doc for the Windows Infrastructure app, it explains where different components are to be installed:

For the Search Head you will see it requires "Splunk App for Windows Infrastructure". In the base app, under default, there is a authorize.conf with the new role. Did you deploy the app to the Search Head? If so, when you browse to the $SPLUNK_HOME/etc/apps/splunk_app_windows_infrastructure/default/ directory, do you see an authorize.conf file?

Jacob
Sr. Technical Support Engineer

rmanni
New Member

Thanks, that is the guide I have been following so far. The authorize.conf file is in the default directory. Do I need to copy it to local?

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

No you shouldn't need to copy it to local. Have you restarted Splunk on the SH since installing the APP? If so, you can look at btool to see if something is taking a higher precedence.

From $SPLUNK_HOME/bin/

./splunk btool authorize list --debug

Do you see the settings?

Jacob
Sr. Technical Support Engineer
0 Karma

rmanni
New Member

Thank you - I did not restart the Splunk service after deploying the app from our deployment server. The winfra-admin and windows-admin roles both show up now.

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

Glad its working for you. 🙂

Jacob
Sr. Technical Support Engineer
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...