topic Re: Role based Index restriction in Deployment Architecture

Role based Index restriction

anirudhk — Tue, 25 Feb 2014 17:13:15 GMT

Hi There,

I am having a Distributed Splunk setup with a Search Head and 2 Indexers. I have few roles setup(Integrated to AD) with in the system with a role associated with a particular Index (srchIndexesAllowed = "" and srchIndexesDefault = ""). But this doesn't actually restrict users from accessing other index if explicitly provided.

I would need this to be implemented in my Environment to have complete control. How can I achieve this.

Regards
Anirudh

Re: Role based Index restriction

anirudhk — Tue, 25 Feb 2014 18:02:16 GMT

srchIndexesAllowed should Ideally have taken care of it. It the user being part of multiple group that caused this behaviour.

Re: Role based Index restriction

martin_mueller — Tue, 25 Feb 2014 20:25:51 GMT

Make sure your roles aren't inheriting more lenient permissions from parent roles.