All Apps and Add-ons

How do I create the winfra-admin role?

rmanni
New Member

I am in the midst of deploying the Windows apps to monitor our AD environment, when I go to setup the Infrastructure app on our search head, I get the following error:

Users and/or groups configured with the winfra-admin user role:
No users or groups with winfra-admin user role detected.
Assign the winfra-admin user role via Splunk Settings >> Access Controls

However, I do not see a winfra-admin role when I go to assign that to a user/group? So is there a specific method to create this role given that it was not created when the app was deployed?

0 Karma
1 Solution

jcrabb_splunk
Splunk Employee
Splunk Employee

Referencing this doc for the Windows Infrastructure app, it explains where different components are to be installed:

For the Search Head you will see it requires "Splunk App for Windows Infrastructure". In the base app, under default, there is a authorize.conf with the new role. Did you deploy the app to the Search Head? If so, when you browse to the $SPLUNK_HOME/etc/apps/splunk_app_windows_infrastructure/default/ directory, do you see an authorize.conf file?

Jacob
Sr. Technical Support Engineer

View solution in original post

jcrabb_splunk
Splunk Employee
Splunk Employee

Referencing this doc for the Windows Infrastructure app, it explains where different components are to be installed:

For the Search Head you will see it requires "Splunk App for Windows Infrastructure". In the base app, under default, there is a authorize.conf with the new role. Did you deploy the app to the Search Head? If so, when you browse to the $SPLUNK_HOME/etc/apps/splunk_app_windows_infrastructure/default/ directory, do you see an authorize.conf file?

Jacob
Sr. Technical Support Engineer

rmanni
New Member

Thanks, that is the guide I have been following so far. The authorize.conf file is in the default directory. Do I need to copy it to local?

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

No you shouldn't need to copy it to local. Have you restarted Splunk on the SH since installing the APP? If so, you can look at btool to see if something is taking a higher precedence.

From $SPLUNK_HOME/bin/

./splunk btool authorize list --debug

Do you see the settings?

Jacob
Sr. Technical Support Engineer
0 Karma

rmanni
New Member

Thank you - I did not restart the Splunk service after deploying the app from our deployment server. The winfra-admin and windows-admin roles both show up now.

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

Glad its working for you. 🙂

Jacob
Sr. Technical Support Engineer
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...