Implementing Splunk 7, Third Edition - Third Edition

authorize.conf

This configuration stores definitions of capabilities and roles. These settings affect search and the web interface. They are generally managed through the interface at Settings | Access controls, but a quick look at the configuration itself may be useful.

A role stanza looks like this:

[role_power] 
importRoles = user 
schedule_search = enabled 
rtsearch = enabled 
srchIndexesAllowed = * 
srchIndexesDefault = main 
srchDiskQuota = 500 
srchJobsQuota = 10 
rtSrchJobsQuota = 20 

Let's walk through these settings:

• importRoles: This is a list of roles to import capabilities from. The set of capabilities will be the merging of capabilities from imported roles and added capabilities.
• schedule_search and rtsearch: These are two capabilities ...