Requirements

  • Splunk Cloud Platform version 9.0.2212 or higher, or Splunk Enterprise version 9.1.0 or higher.
  • You must have a role with the edit_deployment_server and indexes_edit capabilities.
    • If you use Splunk Cloud Platform, the sc_admin role has these capabilities by default. See in the Securing Splunk Cloud Platform manual.
    • If you use Splunk Enterprise, the admin role has these capabilities by default. See Define roles on the Splunk platform with capabilities in the Securing Splunk Enterprise manual.
  • If you use Splunk Cloud Platform you might need to take extra steps to access your deployment through the Splunk REST API. See in REST API Tutorials