Difference between User and Power User in Splunk

Difference between User and Power User in Splunk

 Like other Enterprise tools in the industry, Splunk also gives us the flexibility  for the access control that means you can create user and set their password. In Splunk, basically all the permissions are given based on roles. Users are assigned to one or more roles. Roles contain certain set of permissions / capabilities.

Capability specifies what actions ( such as creating or deleting reports , dashboards , macros etc ) can be performed in the Splunk Enterprise. By default in Splunk Enterprise there are  some predefined roles available.

To know more about users and roles click here : Splunk Users and Roles

We have seen a common questions from most of the employees that “What is the difference between user and power user ” OR “what are all things power users can do?“

So, today we will discuss about the difference between user and power user in Splunk.  Before going to the comparison we will briefly discuss about these two roles.

power – This role has the capability to edit all the  shared objects (reports, macros etc)  alerts, tags, event types and other similar tasks, the number of capabilities is greater than the role user but less than the role admin.

user – This role is limited to create and edit its own objects, set its own preferences, run searches, create and edit event types, and other similar tasks.

So we have created a table to know the difference very easily.

Hope you have understood the difference between user and power user in Splunk.

Happy Splunking !!!