Hello, I would like to know if is it possible and how to hide logs for the administrator user (or role), user that would be able to modify only configurations, without seeing data. Thanks in advance, Luca.
You can set certain privileges via the UI, such as the allowed indexes. Creating a role that does not have search capabilities or searchable indexes would accomplish this. However, since the admin role (by default) has capabilities to edit these same capabilities you would need to disable that functionality. The capabilities that will minimally need disabling are:
change_authentication
edit_roles
search
Also, you would disable all allowed and searchable indexes:
srchIndexesAllowed =
srchIndexesDefault =
Both of these edits can be performed in authorize.conf or via the UI in the Access Control portion of the manager tool.
http://www.splunk.com/base/Documentation/latest/Admin/Addusersandassignroles http://www.splunk.com/base/Documentation/latest/Admin/Authorizeconf
You can set certain privileges via the UI, such as the allowed indexes. Creating a role that does not have search capabilities or searchable indexes would accomplish this. However, since the admin role (by default) has capabilities to edit these same capabilities you would need to disable that functionality. The capabilities that will minimally need disabling are:
change_authentication
edit_roles
search
Also, you would disable all allowed and searchable indexes:
srchIndexesAllowed =
srchIndexesDefault =
Both of these edits can be performed in authorize.conf or via the UI in the Access Control portion of the manager tool.
http://www.splunk.com/base/Documentation/latest/Admin/Addusersandassignroles http://www.splunk.com/base/Documentation/latest/Admin/Authorizeconf