Alerting

Capability needed for 'Log event' alert action

ischoenmaker
Explorer

Does anyone know what capability to assign to a user to be able to use the 'log event' alert action?
The user has OOB power role but when he replicates one of my examples with log event action the events never reach the index. As soon as I reassign the object to my account (OOB Admin role) it works. Seems to be permission issue. From _audit log I also see the alert_actions=logevent is not even started for him:
alt text

Alternatively i can create the searches in my name and configure the log event action. I think in this way the power user can still modify the search when needed and log event will keep working.

0 Karma

mgranger1
Path Finder

In the documentation located here:

https://docs.splunk.com/Documentation/Splunk/7.2.4/Alert/LogEvents

It mentions that "Using the log event alert action requires the edit_tcp capability for users without the admin role."

I'm not positive that this will work for you, but it is certainly a place to start.

Hope this helps,
Matt Granger

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...