Custom roles in Splunk Observability Cloud

Manage users: Create custom roles for users in Splunk Observability Cloud

Predefined roles in Splunk Observability Cloud

Splunk Observability Cloud has built-in roles and the ability to add custom roles. The four built-in roles with predefined capabilities include the following:

  • admin

  • power

  • usage

  • read_only

To see detailed descriptions of the predefined roles, see About roles in Splunk Observability Cloud. Predefined roles are also mapped to capabilities in the Splunk Observability Cloud capabilities table in this document.

Prerequisites

To create custom roles, you must meet the following prerequisites:

How to create a custom role

After setting up Unified Identity and centralized user and role management, Splunk Cloud Platform is the role based access control (RBAC) store for Splunk Observability Cloud. You must create and manage all Splunk Observability Cloud roles in Splunk Cloud Platform. See Create and manage roles with Splunk Web to learn about roles in Splunk Cloud Platform.

To create a custom Splunk Observability Cloud role, follow these steps:

  1. Follow the instructions in the "Add or edit a role" section only of Create and manage roles with Splunk Web.

  2. Specify the custom role capabilities by selecting any combination of capabilities from the table in the following section, Splunk Observability Cloud capabilities.
    Note: Capabilities are always additive in nature. You cannot take away the ability to do something by adding a capability. If you don't want users who hold a role to perform a certain function on your Splunk platform instance, then do not assign that role a capability that lets a user perform that function.

  3. For any user you are assigning the custom role you create here, you must also add the o11y_read_only role to that user directly to provide necessary read functionality.

Splunk Observability Cloud capabilities

The following table lists all of the capabilities that you can add to a role to define the role's permissions in Splunk Observability Cloud:

Table 1. Splunk Observability Cloud capabilities
Capability nameWhat it lets users assigned to this role doadminpowerusageread_only
CREATE_AUTOMATED_ARCHIVAL_EXEMPT_METRICSGrants user permission to generate automated archival exempt metricsXX
CREATE_CHARTGrants user permission to create a new chartXX
CREATE_DASHBOARDGrants user permission to create a new dashboard. You must also assign the CREATE_SHAREABLE_SNAPSHOT capability to allow the user to save the dashboardXX
CREATE_DASHBOARD_DATA_LINKGrants user permission to create a dashboard data linkXX
CREATE_DASHBOARD_GROUPGrants user permission to create a new dashboard groupXX
CREATE_DETECTORGrants user permission to create a detectorXX
CREATE_DIMENSIONGrants user permission to create a new dimensionXX
CREATE_EVENTGrants user permission to create a new eventXX
CREATE_FIELD_ALIASINGGrants user permission to create aliasesXX
CREATE_LOGS_PIPELINEGrants user permission to create a new logs pipeline with processing rulesXX
CREATE_LOGS_QUERIESGrants user permission to create saved logs queriesXX
CREATE_METRICGrants user permission to create a new metricXX
CREATE_METRIC_RULESETGrants user permission to create a metric rulesetXX
CREATE_MUTING_RULEGrants user permission to create a new muting ruleXX
CREATE_PACKAGEGrants user permission to create an SFX PackageXX
CREATE_SHAREABLE_SNAPSHOTGrants user permission to create a shareable snapshot of an existing chart or dashboardXX
CREATE_SLOGrants user permission to create a new service level objectiveXX
CREATE_SSOGrants user permission to create SSO connectionsXX
CREATE_SYNTHETICS_DOWNTIME_CONFIGURATIONGrants user permission to create synthetic downtime configurationsXX
CREATE_SYNTHETICS_PRIVATE_LOCATIONGrants user permission to create synthetic private locationXX
CREATE_SYNTHETICS_PRIVATE_LOCATION_TOKENGrants user permission to create a synthetic private location tokenXX
CREATE_SYNTHETICS_TESTGrants user permission to create synthetic testsXX
CREATE_TAGGrants user permission to create a new tagXX
CREATE_TEAM_MEMBERGrants user permission to add members to existing teams where user is a team managerXX
DELETE_AUTOMATED_ARCHIVAL_EXEMPT_METRICSGrants user permission to delete automated archival exempt metricsXX
DELETE_DASHBOARDGrants user permission to delete an existing dashboardXX
DELETE_DASHBOARD_DATA_LINKGrants user permission to delete an existing data linkXX
DELETE_DASHBOARD_GROUPGrants user permission to delete an existing dashboard groupXX
DELETE_DETECTORGrants user permission to delete an existing detectorXX
DELETE_DIMENSIONGrants user permission to delete an existing dimensionXX
DELETE_EVENTGrants user permission to delete an existing eventXX
DELETE_METRICGrants user permission to delete an existing metricXX
DELETE_METRIC_RULESETGrants user permission to delete an existing metric rulesetXX
DELETE_MUTING_RULEGrants user permission to delete an existing muting ruleXX
DELETE_PACKAGEGrants user permission to delete an existing SFX PackageXX
DELETE_SYNTHETICS_DOWNTIME_CONFIGURATIONGrants user permission to delete synthetic downtime configurationsXX
DELETE_SYNTHETICS_PRIVATE_LOCATIONGrants user permission to delete synthetic private locationXX
DELETE_SYNTHETICS_PRIVATE_LOCATION_TOKENGrants user permission to delete synthetic private location tokenXX
DELETE_SYNTHETICS_TESTGrants user permission to delete synthetic testsXX
DELETE_TAGGrants user permission to delete an existing tagXX
DELETE_TEAMGrants user permission to delete an existing teamXX
DELETE_TEAM_MEMBERGrants user permission to remove an existing team member from a teamXX
READ_LOGS_PIPELINEGrants user permission to view the configured logs pipeline and processing rulesXX
READ_NAMEDTOKENGrants user permission to retrieve and display a list of named tokensXX
READ_ROLEGrants user permission to retrieve and display a list of existing rolesXX
UPDATE_CHARTGrants user permission to make changes to an existing chartXX
UPDATE_DASHBOARDGrants user permission to make changes to an existing dashboardXX
UPDATE_DASHBOARD_DATA_LINKGrants user permission to change existing dashboard data linksXX
UPDATE_DASHBOARD_GROUPGrants user permission to make changes to an existing dashboard group. You must also assign the UPDATE_SHAREABLE_SNAPSHOT capability to allow the user to save the dashboard groupXX
UPDATE_DETECTORGrants user permission to make changes to an existing detectorXX
UPDATE_DIMENSIONGrants user permission to make changes to an existing dimensionXX
UPDATE_FIELD_ALIASINGGrants user permission to update field aliasesXX
UPDATE_INCIDENTGrants user permission to clear an existing incidentXX
UPDATE_LOGS_QUERIESGrants user permission to create, update, and delete saved logs queriesXX
UPDATE_METRICGrants user permission to make changes to an existing metricXX
UPDATE_METRIC_RULESETGrants user permission to make changes to an existing metric rulesetXX
UPDATE_MUTING_RULEGrants user permission to make changes to an existing muting rule objectXX
UPDATE_PACKAGEGrants user permission to update an existing SFPackageXX
UPDATE_RUM_URL_GROUPING_RULEGrants user permission to update the current URL config object (modify, add, or remove rules)XX
UPDATE_SERVICE_CENTRIC_VIEW_CONFIGGrants user permission to create or update an APM Services configuration for a serviceXX
UPDATE_SHAREABLE_SNAPSHOTGrants user permission to update an existing SFPackageXX
UPDATE_SLOGrants user permission to make changes to an existing service level objectiveXX
UPDATE_SYNTHETICS_DOWNTIME_CONFIGURATIONGrants user permission to update synthetic downtime configurationsXX
UPDATE_SYNTHETICS_TESTGrants user permission to update synthetic testsXX
UPDATE_TAGGrants user permission to make changes to an existing tagXX
UPDATE_TEAMGrants user permission to update existing teamsXX
UPDATE_TEAM_MEMBERGrants user permission to update existing members to team managerXX
WRITE_ENTITYGrants user permission to update a discovered entity in the data management UIXX