topic Re: Search all indexes in app in Splunk Dev

Search all indexes in app

benhooper — Mon, 07 Sep 2020 09:05:49 GMT

Is it possible to search only the indexes assigned to a specific app?

So far, the only recommendation I've been able to find is to restrict user roles but that doesn't work for our usage.

Re: Search all indexes in app

gcusello — Mon, 07 Sep 2020 10:55:51 GMT

hI @benhooper,

Sorry!

Splunk has an RBAC approach to access, in other words: access grants are managed at Role level and not at App level.

So, You can assign access to an index only to one or more Roles and not to an App.

At the same time, you can grant access to an app to a Role.

Ciao.

Giuseppe

Re: Search all indexes in app

isoutamo — Mon, 07 Sep 2020 13:10:28 GMT

Hi @benhooper

as @gcusello said, all access has given an index level by user roles. Quite often indexes are defined on one "generic" app for all systems or even in etc/system/local/indexes.conf.

What you could do, is granting access to both app and index to the same user role (group). Just define on

https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Authorizeconf#authorize.conf.example

srchIndexesAllowed = index_a, index_b

for role_XX and then meta.local / meta.default same access to the role_XXX for App_XXX.

Be sure that you don't inherit any roles which already have some srchIndexesAllowed defined otherwise that role will get access to those indexes also.

r. Ismo

Re: Search all indexes in app

benhooper — Mon, 07 Sep 2020 13:42:57 GMT

Hi @gcusello and @isoutamo,

Thanks for your input.

The reason I ask is because our analysts will use Splunk to monitor services for various clients (so they'll all need access to all indexes). To allow for that, we we planning to use a structure like this:

Service / app #1
- Overview dashboard: Search queries starting with index=* ...
- Client #1 dashboard: Search queries starting with index=client1 ...
- Client #2 dashboard: Search queries starting with index=client2 ...
Service / app #2
- Overview dashboard: Search queries starting with index=* ...
- Client #1 dashboard: Search queries starting with index=client1 ...
- Client #2 dashboard: Search queries starting with index=client2 ...

Because the searches aren't restricted to each app / each app's indexes, I guess the results could contain unexpected data.

I suppose we could just change the index names to <app name>_<client name> or something and adjust the search queries appropriately but I was hoping for something more dynamic than that.

Thanks.

Re: Search all indexes in app

gcusello — Mon, 07 Sep 2020 14:47:07 GMT

Hi @benhooper,

I fear you must create a Role for each Client.

Ciao.

Giuseppe

Re: Search all indexes in app

isoutamo — Mon, 07 Sep 2020 15:16:00 GMT

Unfortunately if user has more than one role those settings are merged together 😞 This means that if you need several separate roles for individual analyst then he/she must have several accounts to splunk.

If it's possible I propose you to use prefix on every index which told to which customer it belongs. Anyhow it's not a good habit to make any queries without telling which index you want to use.

And if this is too late then second option is create macro / event type which contains those indexes which belongs to particular customer. Also lookups can used here. E.g. add own lookups / client or one big which contains client, index and then call those via macro.

r. Ismo

Re: Search all indexes in app

benhooper — Tue, 08 Sep 2020 15:44:32 GMT

Thanks for the advice.

I found out that index-based searching support partial wildcards so we're going to name indexes <clientname>_<appname> and use searches index=*_<appname> which seems to work just how we want it.

Re: Search all indexes in app

gcusello — Wed, 09 Sep 2020 06:25:27 GMT

Hi @benhooper,

Good for you.

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated by all the contributors 😉