Different applications need to access all Splunk logs

splunklearner — Tue, 21 Jan 2025 12:47:52 GMT

Hello all,

Consider we have X application requested on-boarding on to Splunk. Created index for this X application, a new role (restricted to X index) and assigned this role to X AD group. Likewise we have Y, Z soon application. We do in the same manner.

But now the requirement is this X,Y,Z application come under 'A' applications and they want all 'A' team members (probably X,Y,Z combined) to view X,Y,Z applications.

How we can achieve this?

Can't create single index for all X,Y, and Z application because the logs should not be mixed.

Re: Different applications need to access all Splunk logs

gcusello — Tue, 21 Jan 2025 13:15:22 GMT

Hi @splunklearner ,

access grants are managed in Splunk at index level, so the best approach is to create different indexes for different grants.

Otherwise, you can put all the events in the same index and, when you create roles, you out a filter for each one, e.g. one role can see only events in index X with sourcetype A or source B.

Ciao.

Giuseppe

topic Different applications need to access all Splunk logs in Getting Data In

Different applications need to access all Splunk logs

Re: Different applications need to access all Splunk logs