topic Re: Access Controls in Security

Access Controls

sameer12sa — Wed, 07 Mar 2012 15:18:07 GMT

Can we have configure users according to the monitors defined at the Universal Forwarder?
We are trying to have a splunk server which monitors mail server and weblogic logs. I am trying to create users who can only access mail server logs and another group which can only access weblogic logs.

Is there any way to do that?

Thanks
Sameer

Re: Access Controls

lpolo — Wed, 07 Mar 2012 15:31:18 GMT

You can do it by defining the roles of each set of users in Splunk. More information:

http://docs.splunk.com/Documentation/Splunk/4.3.1/Admin/Aboutusersandroles

Manager » Access controls

Re: Access Controls

dwaddle — Wed, 07 Mar 2012 16:54:22 GMT

The most robust approach is to put each different role's data into its own index. You'd have a "mail" index and a "weblogic" index, and each inputs.conf stanza would explicitly say index=<foo>. Then, you configure each role as to the index(es) it's allowed to use, and drop the users into the proper roles .... and Bob's your uncle.