Hide scheduled search from indexer

sscholz — Mon, 15 Mar 2021 07:44:58 GMT

Hello Guys,

we would like to do a group project/contest where different SHs are connected to a IDX-Cluster.

Each SH is for one contestant and the should solve severall search-tasks on the indexed data.

Is there a possibility to "hide" the searches from the indexed data at the indexer cluster or any other splunk-server? So that the contestants could not cheat, if the can look into the _internal index?

I know, that we could restrict the access to the _internal, but let us assume all of them have admin-rights AND access to the shell of the underlying OS?

My guess, it is not possible to hide such a search from the rest of the splunk servers (except the executing SH), because the IDX had to search the data itself. Even not forwarding the internal data to the indexer does not help here. Am I right?

Thanks in advance.

BR, Tom

topic Hide scheduled search from indexer in Splunk Enterprise

Hide scheduled search from indexer