1. Home
  2. Getting Started
  3. User Roles and Permissions

User Roles and Permissions

This article discusses roles in Splunk On-Call and provides a detailed breakdown of the specific permissions allocated to each role. It will also review how to change the roles for users.

There are five roles in Splunk On-Call:

  • Global Admin: Global access, no restrictions
  • Team Admin: Manages people and scheduling on a team basis
  • Alert Admin: Manages the technical aspects of creating and optimizing alerts
  • User: Alert response
  • Stakeholder: Read-only awareness

Global Admin, Alert Admin, User, and Stakeholder are global roles. The Team Admin role is assigned on a team basis. This means that a user that is a Team Admin for one team has permissions to manage people and schedules for only that team.

This means that a user can hold two roles. Here are the possible combinations:

  • User & Team Admin
  • Alert Admin & Team Admin

Stakeholders can be considered separate from all other roles as these users cannot be placed in any on-call schedules nor take action on incidents.  They can simply be added to existing incidents and notified through their defined contact methods for awareness.  For comprehensive information on stakeholders, please see this article.

The next sections provides a detailed breakdown of the specific permissions for each role.

User Permissions

User Management

  Global AdminAlert AdminTeam AdminUserStakeholder
Invite User

Delete User

Increase Seats

User ProfileView

ownFor users on team(s) where they are a Team Adminownown
Manage Contact Methods

ownFor users on team(s) where they are a Team Adminownown
Manage Paging Policies

ownFor users on team(s) where they are a Team Adminownown
Manage Global Roles

Promote User to Team Admin

For team(s) where they are a Team Admin

Team Management

  Global AdminAlert AdminTeam AdminUserStakeholder
TeamCreate

Rename

For team(s) where they are a Team Admin
Delete

For team(s) where they are a Team Admin
UsersAdd

For team(s) where they are a Team Admin
Remove

For team(s) where they are a Team Admin
Make Team Admin

For team(s) where they are a Team Admin
RotationsView

For team(s) where they are a Team Admin

Create

For team(s) where they are a Team Admin
Edit

For team(s) where they are a Team Admin
Delete

For team(s) where they are a Team Admin
Escalation PoliciesView

For team(s) where they are a Team Admin

Create

For team(s) where they are a Team Admin
Edit

For team(s) where they are a Team Admin
Delete

For team(s) where they are a Team Admin
Scheduled OverridesTake

Create

For themselvesFor users on team(s) where they are a Team AdminFor themselves
Assign

For Escalation Policies within a team where they are a Team Admin
Reset assignee to NULL

For their ownFor Escalation Policies within a team where they are a Team AdminFor their own
Delete

For their ownFor their ownFor their own

Alert/Incident Management

  Global AdminAlert AdminTeam AdminUserStakeholder
IntegrationsView

Enable

Revoke

Incident ConfigurationsView

Edit

Routing KeysView

Create

Update

Delete

Rules EngineView rules

Preview Rule

Create

Edit

Reorder

Enable

Disable

Delete

Outgoing WebhooksView

Create

Edit

Delete

Enable

Disable

On-Call APICreate key

Delete key

Rename key

Revoke ALL keys

On-call Actions

  Global AdminAlert AdminTeam AdminUserStakeholder
Manual Take On-callTake On-call

Take BackIf they are the user who's shift was taken (ex: Jason takes for Sarah, Sarah can Take Back. This is not role dependent)
Clear Take

Only if they are the person who took the on-call shiftFor escalation policies within a team where they are a Team AdminOnly if they are the person who took the on-call shift
Maintenance ModeEnter

Exit

Conference BridgesStart

End

Incident ActionsView

View stakeholder information on specific incidents that a user has added them to
Ack

Ack All

Resolve

Resolve All

Reroute

Snooze

Edit Snooze timeOnly the user who snoozed the incident can change the time, this is not role-dependent
Add Stakeholders to Incidents

Create Manual Incident

Billing

  Global AdminAlert AdminTeam AdminUserStakeholder
Change Billing Contact Info

Add payment method

Update payment method

Download invoice (PDF)

Reporting

  Global AdminAlert AdminTeam AdminUserStakeholder
Post Incident ReviewView

Print

Create

Edit

For reports they created

For reports they created
Delete

For reports they created

For reports they created
Performance (MTTA/MTTR)View

Print

On-callView

Print

Incident FrequencyView

Print

How to Change Global Roles

Only Global Admins can change the user roles. This includes other Global Admins.

To change a user’s global role, navigate to Users, and click on the name of the user to access their profile page.

You may change the role of that user by selecting a new role from the Role dropdown. Your changes will save automatically.

For information on how to manage Team Admin permissions, please visit the How to set up Team Admins article.

For more information regarding overall Admin permissions, including the Alert Admin role, please follow the link our How to Manage Admin Permissions Knowledge Base article.

How to change Stakeholder Roles

Users can be converted to or from a stakeholder role with the assistance of the support team.  Please note that Stakeholders are priced differently from all other user roles so additional charges may be incurred if converting someone from a stakeholder to another role.

If interested in a stakeholder conversion, please contact the support team and include the specific user(s) you’d like to convert and what role you’d like them converted to.  If converting from one of the user role types to a stakeholder, please ensure that the user is removed from all rotations and escalation policies and isn’t actively being paged for any incidents.

Updated on July 27, 2023

Was this article helpful?

Related Articles