Hi Team,
I have recently installed (https://splunkbase.splunk.com/app/1546/#/overview) this app in our search head. But as an admin I can able to navigate to Settings-->Data Inputs-->REST and I can able to provide the inputs.
But as a user role couldn't able to view the Data Inputs itself and he couldn't able to add the Data Inputs in REST API.
So for a user how come we need to provide access to add their Data Inputs in REST API.
Kindly help on this request.
Try to assign following capabilities to your user role.
edit_monitor - for "Add Data" option show up in the settings menu.
indexes_edit -for users index name show up in the Indexes drop down when uploading the file.
edit_tcp - for actual file upload
search - for previewing the uploaded file.
Please note that a regular user can setup monitoring/upload a huge file, which may have sensitive data and consume a chunk of license. (that's probably the reason they leave the data upload to admins).
Thanks for your response.
As mentioned I have added the below stanza for the user role.
edit_tcp = enabled
edit_monitor = enabled
indexes_edit = enabled
search = enabled
And now I can able to see the Data Inputs in the user role with Local inputs .
Under Local Inputs i can able to see a option as Type in that i can able to see "Files & Directories" & "TCP" but I couldn't able to find "REST" in the same.
So what needs to be done so that "REST" is also visible under Local Inputs for user role too.
Also i have added the following stanza into it but still REST is not visible so kindly help on this.
edit_rest = enabled
Based on my answe if you give admin_all_objects then only it will available to end user which is not recommended.
Hi @anandhalagarasan,
For testing purpose I have created new role and imported user
role and try to assign different capabilities and found that only admin_all_objects
capability will allow this and I'll not recommend you to assign this capability for end user because that capability will enable many more feature.