Security

Administration

bhavna_jain
Engager

Hi, What capabilities are needed for a non admin role to create their own index.
I have tried with edit_index but its not working.

Plz suggest some solutions.

Tags (1)
0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

There is not a capability that is available that allows the creation of indexes in the way that you want.

I would argue this is not something you want a non-admin to do anyways because it could affect the storage of your indexer.

If you don't trust them to be an admin why would you trust them to allocate space on the indexer's disk?

What are you trying to accomplish by having users create indexes. Are you trying to secure data? Are you trying to segregate to make it easier to search?

okrabbe_splunk
Splunk Employee
Splunk Employee

ok. I would recommend that you look at setting some best practices for your users that are onboarding data. You can do this as an admin by setting up indexes for them to use if necessary.

However, if users are indexing data that is for the same purpose, it probably should exist in the same index. You would want to teach them how to search for their specific data based on hostname, source or sourcetype.

You should take some time and look through this manual:
http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor

bhavna_jain
Engager

I am trying to segregate so that there will not be any mess up. For ex. if there are two non admin users with same role and they are indexing data in the asme index than it won't be easy for them to search within their own data. but if they are uploading data in their own indexex it will be easy. So i want them to create their own index.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...