SIR Analysts are not able to edit Notable Event Selection on Splunk ES Event Profiles

sath
Tera Expert

Hi,

We have modified create and write ACLs on Splunk ES Event Profiles so that SIR Analysts can create new splunk profiles and edit the existing ones. They are able to modify the values under Name, Mapping, Schedule and Additional options, but not able to edit profiles under Notable Event Selection and also not able to fetch sample data under mapping, see the error "error while fetching sample events". Do we need to modify any additional ACLs for them to edit?Screenshot 2024-02-15 at 1.35.06 PM.png

0 REPLIES 0