Configure roles

Configure flexible roles by editing authorize.conf. Roles are defined by lists of capabilities. You can also use roles to create granular access controls by setting a search filter for each role.

Caution: Do not edit or delete any roles in $SPLUNK_HOME/etc/bundles/default/authorize.conf. This could break your admin capabilities. Make all changes in $SPLUNK_HOME/etc/bundles/local/authorize.conf. For more information, read about how configuration files work.

Configuration

Add the following attribute/value pairs to $SPLUNK_HOME/etc/bundles/local/authorize.conf.

[role_$ROLE_NAME]
$CAPABILITY1 = enabled
$CAPABILITY2 = enabled
...
importRoles = $OTHER_ROLE
srchFilter = $SEARCH_STRING

role_$ROLE_NAME:
- the name you want to give your role, for example security, compliance, ninja.
$CAPABILITY1:
- any capability from the list below. You can have any number of capabilities for a role.
importRoles = $OTHER_ROLE:
- when set, the current role will inherit all the capabilities from $OTHER_ROLE.
srchFilter = $SEARCH_STRING:
- use this field for granular access controls. Set a search string to filter on.
- when a user is assigned to multiple roles where a srchFilter restriction is set for one but not the other role, you'll need to explicitly set the srchFilter for the other role in order to keep it from being restricted by the other role. For example, for a user who is assigned to both Admin and User roles, by setting the Admin srchFIlter = *, you prevent the user from being restricted to only searching on source=/test

[role_Admin]
srchFilter = *

[role_User]
srchFilter = source::/test

valid search strings

The srchFilter field can include any of the following search terms:

source::
host:: and host tags
eventtype:: and event type tags
search fields
wildcards

The search terms cannot include:

indexes
source types
saved searches
time operators
regular expressions
any fields or modifiers Splunk Web can overwrite

map a role to a user

Once you've created a role in authorize.conf, map it to a user via Splunk Web.

Click on the admin link in the upper right-hand corner.
Then, select the Users tab.
Enter the username, password and full name.
Choose which role to map to from the Role list.
- Any custom roles you have created via authorize.conf should be listed here.

Note: You must restart Splunk after making changes to authorize.conf. Otherwise, your new roles will not appear in the Role list.

Example

The following example creates the role of Ninja. This user can do everything listed as capabilities (eg edit_input). Also, the Ninja role imports the capabilities of the Security and Compliance roles -- meaning Ninja can do everything (and more) that Security and Compliance can do. Additionally, there is a search filter which means that Ninja can only run searches on hosts swan or pearl.

[role_Ninja]
edit_input                = enabled
delete_input              = enabled
edit_global_save_search   = enabled
delete_global_save_search = enabled
create_alert              = enabled
start_alert               = enabled
start_global_alert        = enabled
stop_alert                = enabled
stop_global_alert         = enabled
save_local_eventtype      = enabled
edit_role_search          = enabled
edit_local_search         = enabled
edit_saved_search         = enabled
savesearch_tab            = enabled
allow_livetail            = enabled
importRoles = Security;Compliance
srchFilter = host=swan OR host=pearl

Previous: SSL | Next: Set up LDAP

Comments

I've added instructions to map a role to a user.
Posted by emma on Apr 22 2008, 1:10pm
Can you assign a default dashboard to an entire role?
Posted by zz2056 on Apr 17 2008, 12:39pm
Click the edit link next to the username, and then select the role(s) that you want that user to be a member of.
Posted by m@ on Mar 26 2008, 9:55am
How do you associate a role with a user?
Posted by goldburtd on Mar 26 2008, 9:13am