Splunk 7.x Quick Start Guide

Managing Splunk roles

Regardless of which authentication method you employ, as your environment grows, you will want to create and assign specific roles to your various user groups to manage the capabilities they can exercise; which indexes, reports, and dashboards they can access, and whether they can only view the data or have the ability to create and edit Splunk knowledge objects and reports, and schedule searches to populate them. In addition, you can set parameters for the various roles to control how many concurrent searches a user or role can run, how much disk space their searches can consume, and a number of other limitations to help manage the capacity and performance of your Splunk environment.

The best way to get familiar with ...