Documentation:
3.2.3
This page last updated: 04/15/08 03:04pm
authorize.conf
Use this file to configure roles and granular access controls.
authorize.conf.spec
# Copyright (C) 2005-2008 Splunk Inc. All Rights Reserved. Version 3.0
#
# This file contains possible attribute/value pairs for creating roles in authorize.conf.
# You can configure roles and granular access controls by creating your own authorize.conf.
# There is an authorize.conf in $SPLUNK_HOME/etc/bundles/default/. To set custom configurations,
# place an authorize.conf in your own custom bundle directory.
#
# For help creating a bundle directory, or to learn more about bundles (including bundle precedence)
# please see the documentation located at http://www.splunk.com/doc/latest/admin/bundleconfig.
[capability::<capability>]
* Define a capability in Splunk.
* This can also be added dynamically by software registering in the
system (see restmap.conf.spec).
* Splunk adds most of its capabilities this way so they are enumerated
at the end of the file for reference.
* See below for the default list of capabilities.
[role_<roleName>]
<capability_name> = <enabled|disabled>
* Capability attached to this role.
* You can list many of these.
importRoles = <string>
* Semicolon delimited list of other role capabilities that should be imported.
srchFilter = <string>
* Semicolon delimited list of search filters for this Role.
# The following is a list of Splunk's capabilities. NOTE: This list is subject to change as
# new capabilities are added and old ones are deprecated. If you encounter problems while
# configuring authorize.conf, please contact support@splunk.com.
access_datamap
access_datastore
admin_operator
allow_livetail
allow_shutdown
bounce_authentication
change_authentication
config_management
delete_by_keyword
delete_user
distributed_all_tab
distributed_forward_tab
distributed_receive_tab
distributed_search_tab
edit_admin_tabs
edit_alert_action
edit_audit
edit_deployment_class_mapping
edit_deployment_client
edit_deployment_server
edit_eventtype
edit_event_discoverer
edit_exec
edit_field_actions
edit_fifo
edit_filter
edit_forward_server
edit_fschange
edit_index
edit_input_defaults
edit_local_search
edit_metaevents
edit_prefs
edit_props
edit_roles
edit_role_search
edit_saved_search
edit_search_server
edit_segmenter
edit_server
edit_server_config
edit_source_classifier
edit_splunktcp
edit_splunktcp_ssl
edit_ssl
edit_tags
edit_tail
edit_tcp
edit_transform
edit_udp
edit_user
edit_watch
edit_web_settings
get_config_by_type
get_config_file
get_metadata
get_property_map
get_user_prefs
get_typeahead
kick
kickProcessor
license_tab
list_inputs
list_saved_searches
request_auth_token
run_script_createrss
run_script_diff
run_script_gentimes
run_script_head
run_script_idxprobe
run_script_iplocation
run_script_loglady
run_script_marklar
run_script_reportcache
run_script_runshellscript
run_script_sendemail
run_script_transpose
run_script_uniq
run_script_windbag
run_script_xmlkv
run_script_xmlunescape
savesearch_tab
save_user_prefs
schedule_search
search
search_admin_index
server_auth_config_tab
server_control_tab
server_settings_tab
set_user_prefs
sync_auth
target_processor
user_tab
use_file_operator
write_config_splunkd# This is an example authorize.conf. Use this file to configure roles and capabilities. # # There is a default authorize.conf in $SPLUNK_HOME/etc/bundles/default/. Use this example file to # create your own custom authorize.conf. # # To set custom configurations, place an authorize.conf in your own custom bundle directory. [role_Ninja] edit_save_search = enabled schedule_search = enabled edit_eventtype = enabled edit_role_search = enabled edit_local_search = enabled savesearch_tab = enabled edit_tags = enabled importRoles = User;Everybody srchFilter = host=foo # This creates the role Ninja, which inherits capabilities from the default roles User and Everybody. # Ninja has almost the same capabilities as Power, except cannot create alerts (only saved searches). # Also, Ninja is limited to searching on host=foo.
Comments
No comments have been submitted.