Troubleshoot roles and capabilities

Following are some issues that you might see when using managing roles and capabilities in Splunk Enterprise Security version 8.8 and higher:

Roles and capabilities page is unavailable

Issue: Roles and capabilities page does not display.

Cause: You do not have the required permissions.

Solution: Ensure that you have the admin_all_objects capability.

Unable to edit a predefined role

Issue: Unable to edit a predefined role

Cause: Predefined roles are read-only.

Solution: Create or update a custom role instead of a predefined role.

Capability is not turned on

Issue: A capability is checked but is not turned on.

Cause: The capability might be inherited or required by another permission that is turned on.

Solution: Review the Roles and capabilities page to verify the role and capability relationships and verify that the capability must be on for that role.