Splunk 7.x Quick Start Guide

Working with authentication.conf and authorize.conf

As in any other Splunk administration endeavor, it will serve you well to understand what the various entries in the authentication.conf and authorize.conf files do, and how these two files work together to control authentication and access to Splunk functions.

There is an authentication.conf and authorize.conf file located in $SPLUNK_HOME/etc/system/default that establishes the default settings for Splunk-based authentication and its default roles. When you modify any default setting using Splunk web, these changes are stored in the respective files in .../etc/system/local. You can, of course, edit these .conf files directly instead of using Splunk Web. You can also create smaller versions ...