Splunk Enterprise Certified Admin Practice Test

When adding a Search Peer in Splunk, which capability must the user account possess?

1. Edit_roles

2. Edit_user

3. Admin

4. Search

The correct answer is: Edit_user

To add a Search Peer in Splunk, a user account must possess the capability to edit user settings, which is inherent in the capability of editing roles or user accounts. This capability allows the account to manage user settings and configurations within the Splunk environment, including the ability to add new search peers. Having the ability to edit users or roles is critical since adding a search peer can involve adjusting configurations that are associated with user roles and permissions. Without this capability, a user would be restricted from making the necessary changes or additions to the search infrastructure. The other capabilities, while important in different contexts within Splunk's operations, do not specifically provide the necessary permissions needed to manage search peer configurations. The Admin capability includes a broader range of permissions but is not as directly relevant in the context of adding a search peer, focusing instead on overall system administration. Similarly, the Search capability simply allows users to execute searches and does not grant permissions for managing system settings.