Access control, roles, and capabilities
Review human-user access, dataset permissions, service-account capabilities, sharing controls, and audit expectations for Machine Data Lake workflows.
User access and dataset permissions
The Catalog uses Splunk role-based access control (RBAC). Users see only the datasets and actions that their roles, dataset permissions, and administrator privileges permit.
Dataset-specific access levels are cumulative. Streaming promote, static promote, query, and view includes the lower access levels. Static promote, query, and view includes query and view access. Query and view includes view access.
Dataset-specific access does not by itself grant edit, sharing, deletion, or administrative capabilities. Those actions require the corresponding management, sharing, or administrator capability for the dataset type and environment.
Use the least-privileged dataset access level that supports the task. Before granting access, verify the required action and dataset type in the permissions table in this topic.
Required permissions by action
| Action | Required access, role, or capability | Notes |
|---|---|---|
| View a dataset in the Catalog | Dataset View access, inherited higher dataset access, dataset ownership, admin, sc_admin, or another administrator role. |
View access permits dataset listing and metadata inspection. |
| Search or query a dataset | Dataset Query and view access or a higher dataset access level, plus access to the supported search path. | Query access also includes view access. |
| Create a raw table | admin, sc_admin, or another role that can create Machine Data Lake raw tables, plus Data Management access and the required Data Management service-account role. |
The workflow also depends on the Data Management connection, search-head target, Ingest Processor readiness, and SPL2 service readiness. |
| Edit raw table settings or landing definition | Dataset editing or management permission for the raw table. Direct Ingest Processor pipeline editing can require the relevant Ingest Processor management capability, such as admin_all_objects where that capability is required. |
Landing edits affect future matching behavior after the changes are saved. |
| Create a static promotion | Dataset Static promote, query, and view access or Streaming promote, static promote, query, and view access on the source raw table. | Static promotion access includes query and view access. |
| Create a streaming promotion | Dataset Streaming promote, static promote, query, and view access on the source raw table. | Streaming promotion access includes static promotion, query, and view access. |
| Share data or configure Open Sharing | Sharing or Open Sharing capability where supported, plus the dataset access required for the source dataset and the supported sharing workflow. | Share only the dataset and access duration that match the authorized use case. Revoke the profile or token when access is no longer authorized or needed. |
| Delete a dataset | Required dataset management permission for that dataset type, admin, sc_admin, or another administrator role. |
Confirm lifecycle impact before deleting raw, promoted, streaming, shared, or downstream data. For details, see Retention and deletion lifecycle. |
Grant or revoke dataset access
- During raw table creation or from the dataset Manage tab, open the access-control settings for the dataset.
- Add the required roles or named accounts.
- Select the least-privileged access level that supports the work: View, Query and view, Static promote, query, and view, or Streaming promote, static promote, query, and view.
- Save the dataset settings if the workflow requires saving.
- To revoke dataset-specific access, remove the role or account from the dataset access list and save the change. Also review role-based, administrator, and inherited access that might still make the dataset visible.
For the dataset creation workflow, see Create a Machine Data Lake raw table. For dataset management, see Manage Machine Data Lake datasets.
Data Management service account role
Machine Data Lake uses the role assigned to the Data Management service account for service-to-service operations between Data Management and Splunk Cloud Platform. This role must be provisioned for the same search head unit or search head cluster that the Data Management connection uses. To learn how to set up this role, see Machine Data Lake prerequisites.
Follow Machine Data Lake prerequisites to create or update the Data Management service account role. Machine Data Lake requires the role to include the following capabilities:list_search_head_clustering, edit_spl2_datasets, edit_connections, edit_datasets, read_datasets, write_datasets, read_connections, indexes_edit, and search. If the documented setup does not complete successfully, the role is missing, or the required capabilities are incomplete, contact Splunk Support.
Open Sharing and audit
Where Open Sharing is available for your Splunk Cloud Platform environment and dataset type, users with the required sharing permissions can create, download, revoke, and set expiration for sharing profiles or tokens. Sharing provides read-only access to the selected dataset for the configured access period.
To grant access, configure sharing on the dataset, set the expiration or access duration required by the use case, and provide the generated profile or token only to authorized users or systems. To revoke access, use the dataset sharing controls to revoke the profile or token. Splunk can record sharing actions in audit data.
Job visibility
Promotion jobs are visible to the job owner and to administrators with the relevant management capability. Users can manage only the jobs and datasets that their role and dataset permissions allow.