topic Re: Filter / Mask / Anonymize raw data by role at search time in Getting Data In

Filter / Mask / Anonymize raw data by role at search time

splunkreal — Thu, 30 Nov 2023 22:52:12 GMT

Hello,

regarding filtering Splunk roles, we would like to only allow transforming commands (stats, timechart...) for users on a specific search head. This search head is not part of the cluster, only querying clustered indexers. The aim is to avoid specific users from accessing raw indexes data, only show statistics.

At the moment we use summary indexing in local index by scheduling reports with sistats or sitimechart but it's long and heavy to convert searches.

Thanks for your help.

Re: Filter / Mask / Anonymize raw data by role at search time

gcusello — Fri, 01 Dec 2023 07:06:07 GMT

Hi @splunkreal ,

you have two solutions to do this:

copy your data in a summary index, copying only the data you want to share and creating special dashboards to see these data.

Creating an app with dashboards with disabled access to the Search and Reporting dashboard.

I prefer the first solution.

Ciao.

Giuseppe

Re: Filter / Mask / Anonymize raw data by role at search time

splunkreal — Fri, 01 Dec 2023 13:27:25 GMT

Hi @gcusello we already use summary indexing with local index on that particular search head. Thanks.

Re: Filter / Mask / Anonymize raw data by role at search time

gcusello — Fri, 01 Dec 2023 13:39:56 GMT

Hi @splunkreal ,

I suppose that you have your summary indexes on the Indexers, not on Search Heads!

if not review this position, you can have the correct result centralizing summary indexes on the Indexers.

So, you already have all that you need for anonymizing data.

Let me know if I can help you more, otherwise, please accept one answer foer the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Filter / Mask / Anonymize raw data by role at search time

splunkreal — Fri, 01 Dec 2023 13:46:17 GMT

Hi @gcusello

this works fine, you can see Stephen_Sorkin answer at https://community.splunk.com/t5/Getting-Data-In/Summary-indexing-on-a-search-head/m-p/34175

Splunk expert told me I may test this : https://community.splunk.com/t5/Getting-Data-In/Search-time-Mask/td-p/14363

[mysourcetype] EXTRACT-out = (?s)^(?:\<\d+\>)?(?<altraw>.*) FIELDALIAS-raw = altraw as _raw

What do you think?

Thanks for your help!