What Capability Does a Power User Need to Create a Log Event Alert Action?
Short answer
C edit_tcp
Question
Key Takeaways
This question tests your understanding of capability-based access control for Splunk alert actions, and the common trap is confusing generic alert-editing capabilities with specific requirements like edit_tcp for Log Event alerts.
Discover the required Splunk capability for creating a Log Event alert action. The community confirms that edit_tcp is necessary, not edit_alerts, as outlined in Splunk Fundamentals and official documentation.
Common mistake: The most common wrong answer is D (edit_alerts), because many candidates assume alert creation always needs edit_alerts, but Log Event alert action specifically requires edit_tcp to set up the TCP input that the action uses.
Expert Analysis
Why the Answer Is Correct
The correct answer is C (edit_tcp). According to Splunk Fundamentals and community response [1], the edit_tcp capability allows users to configure TCP inputs, which is a prerequisite for creating a Log Event alert action. This capability is required because the Log Event action relies on TCP input configuration to function properly. Without edit_tcp, a power user cannot create this specific alert action, even if they have general alert-management rights.
Why the Other Options Are Wrong
A (edit_search_server) is incorrect because it controls search server settings, not alert action creation. B (edit_udp) is wrong because Log Event alerts use TCP, not UDP, for event forwarding. D (edit_alerts) may seem correct since alerts are involved, but as comment [2] explains, edit_alerts would only be the answer if the option were specifically 'edit_log_alert_event' — for the Log Event action itself, edit_tcp is the required capability. Community comment [3] reinforces that Splunk documentation highlights edit_tcp as the necessary capability for non-admin roles.
Community Comment Notes
Comment [1] correctly points to the Splunk Fundamentals slide that lists edit_tcp as the answer. Comment [2] provides a helpful explanation of why edit_alerts is a distractor and suggests that a different capability name would be needed for the answer to be D. Comment [3] cites the Splunk Community discussion and documentation, confirming that edit_tcp is required for Log Event alert actions. Comment [4] incorrectly argues for edit_alerts, illustrating the common misconception. The majority vote (80%) supports C, aligning with documented requirements.
Official Reference
- https://docs.splunk.com/Documentation/Splunk/latest/Alert/LogEvent
- https://docs.splunk.com/Documentation/Splunk/latest/Security/Listofcapabilities
These links open the official vendor documentation in a new tab.
Exam Strategy
Remember that different alert actions require different capabilities beyond just 'edit_alerts'. For Log Event alerts, focus on edit_tcp because the action sends data via TCP; review the capabilities matrix in Splunk documentation before the exam.
Community Votes
80% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
Eddie_exam 👍 2 Answered CCorrect answer is C. See Fundamentals 3 slide 108.
-
teeec 👍 1 Answered CThe edit_tcp capability allows users to configure TCP inputs, which is necessary for setting up certain alert actions, including the Log Event alert action. Assigning this capability to a power user enables them to create and manage Log Event alert actions effectively. Would be D if the D option is edit_log_alert_event
-
cagdaskarabag 👍 1 Answered CTo create a "Log Event" alert action in Splunk, a user without the admin role requires the edit_tcp capability. This is necessary to ensure that the log event action functions properly, as highlighted in the Splunk Community discussion and documentation
-
ykamalharsha 👍 1 Answered DTo create a Log Event alert action in Splunk, a power user needs the edit_alerts capability. This capability allows users to create, edit, and manage alert actions, including Log Event alerts
-
Derag 👍 1It is C. If not admin, a power user should have edit_tcp to create a log event alert.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SPLK-1004 Questions
Access 130 questions with complete answers and detailed explanations.
View Full SPLK-1004 Practice Test →