Splunk Add-on for ServiceNow: Alternative Way for Non-Admin Users to Create Alerts and Searches

Applicability

Description

In the Splunk Add-on for ServiceNow, creating searches and alerts typically requires certain capabilities.

By default, users need either:

• Splunk Administrator role
• list_storage_passwords and schedule_search capabilities

However, in cases where granting admin privileges or these capabilities is not feasible, there are alternative ways for non-admin users to create and manage searches and alerts.

The alternative methods include:

• custom generating search commands
• custom alert actions
• alert-triggered scripts
• custom streaming search commands

This article outlines the investigation and resolution steps to enable non-admin users to create searches and alerts securely.

Investigation

An alternative approach was identified that allows non-admin users to create and save searches or alerts without requiring admin capabilities or additional Splunk permissions.

Resolution

To enable non-admin users to create and use searches and alerts without requiring admin privileges, follow these steps:

1. Configure Saved Searches & Alerts as Global
   Navigate to Settings -> Searches, Reports, and Alerts.
   Ensure the saved search or alert is configured as Global.
   Set the Owner to "nobody" so it is accessible to all users with appropriate permissions.
2. Grant Necessary Permissions to Non-Admin Users
   Provide read and run permissions for global saved searches.
   Assign the create_search capability to allow non-admin users to create and manage their own searches and alerts.

By implementing these configurations, non-admin users can create and manage searches and alerts in the Splunk Add-on for ServiceNow without requiring admin access or additional capabilities.

Related Links

Splunk Add-on for ServiceNow