topic Re: Field Extraction Restriction in Security

Field Extraction Restriction

rashi83 — Fri, 23 Aug 2019 19:43:27 GMT

Hi,
I want to restrict field extraction capability to users in Splunk system. I want to provide this capability just to Admin users.
If this is not possible , can users create private extractions and only admin can make them global - just trying to put control around the splunk system,

thoughts?

Re: Field Extraction Restriction

solarboyz1 — Fri, 23 Aug 2019 20:05:03 GMT

can users create private extractions and only admin can make them global

This is exactly how it works. As long as the users do not have write access to the apps, they will only be able to create private objects.

Re: Field Extraction Restriction

rashi83 — Wed, 28 Aug 2019 14:57:05 GMT

@solarboyz1 -What is the name of capability that can control write access to the apps? Could you please share

Re: Field Extraction Restriction

solarboyz1 — Wed, 28 Aug 2019 15:04:44 GMT

Its not a capability, it's permissions on the app.

App dropdown -> Manage Apps -> {Selected App} Permissions

It lists the roles, and if the have read and/or write permissions.

Re: Field Extraction Restriction

rashi83 — Wed, 28 Aug 2019 15:54:49 GMT

thanks , so I have READ permission to Everyone and Write permission to Admin and Power user only.
But Still I see "normal user" can create global field extractions.

Re: Field Extraction Restriction

solarboyz1 — Wed, 28 Aug 2019 16:05:22 GMT

https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Apparchitectureandobjectownership

To make an object global the user requires the capability:

admin_all_objects capability