topic Re: indexaccess on appcontext basis in Splunk Enterprise

indexaccess on appcontext basis

TheEggi98 — Fri, 14 Mar 2025 10:25:05 GMT

Hi splunkers,

is it possible to restrict indexaccess to specific appcontext?

like a user has read access to app a and write access to app b
app a has dashboards on index a
inside app b has dashboards on index b but searching through index a is not allowed inside app b

because we have built a firewall selfservice, where people can check if their connection get blocked by firewall and if so, they can open a ticket by one click.

Now we encounter some usergroups that want to be able to search on their own in their own app.
With this, they currently could freely search and analyse our firewall data beyond checking if their connection gets blocked or not.

How can we achieve accesscontrol like this if its even possible?

Thanks in advance!

Re: indexaccess on appcontext basis

isoutamo — Fri, 14 Mar 2025 10:49:01 GMT

this is not possible. Index access and app access are two separate "entities" in splunk. This is explained here quite well and this is the way how you should implement your RBAC access to splunk.

https://conf.splunk.com/files/2023/slides/PLA1169B.pdf

r. Ismo

Re: indexaccess on appcontext basis

TheEggi98 — Fri, 14 Mar 2025 11:53:16 GMT

I already expected this answer but hope dies last ^^