I'm trying to set up a role in one of our splunk servers (running 4.1.5 on a 64 bit redhat linux 5 machine). What I really want to do is create a role that has almost all admin capabilities except the ability to delete data and modify roles. This role should be able to create indexes and start/stop splunk.
I see that there are some capabilities that seem to grant this (like restart_splunkd). However, while I can these capabilities to a role, I noticed that all roles except the built-in "admin" role are missing certain sections in the manager section. Logging in with a user that has the admin role, I see the following on the right column under "System configurations"
-System settings
-Server controls
-License
-Data inputs
-Forwarding and receiving
-Indexes
-Access controls
-Distributed search
-Deployment
-User options
However, if I grant a role the ability to restart splunk, and place a user in that role, logging into the manager section with that user only shows one item on the left under "System Configurations", which is the "User options" section.
I've even gone as far as cloning the "admin" role and trying to log in with that newly (and unmodified after the clone) role, and I still do not see the full list of options in the Manager under "System configurations".
So, since I figure I'm missing something very obvious, can someone either point me in the right direction, or confirm that what i'm trying to do is just not possible?
-Joseph
