SIR Analysts are not able to edit Notable Event Selection on Splunk ES Event Profiles
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-15-2024 11:43 AM
Hi,
We have modified create and write ACLs on Splunk ES Event Profiles so that SIR Analysts can create new splunk profiles and edit the existing ones. They are able to modify the values under Name, Mapping, Schedule and Additional options, but not able to edit profiles under Notable Event Selection and also not able to fetch sample data under mapping, see the error "error while fetching sample events". Do we need to modify any additional ACLs for them to edit?
0 REPLIES 0