topic Re: Is there a way to restrict Splunk admin access to search for index=*? in Knowledge Management

Is there a way to restrict Splunk admin access to search for index=*?

Navanitha — Mon, 22 May 2023 17:58:14 GMT

How to restrict access for a Splunk admin role from being able to run index="*" search. This is killing our Splunk resources and need to restrict the access. Apart from User awareness / Education, is there any way to implement this ?

Re: Is there a way to restrict Splunk admin access to search for index=*?

richgalloway — Mon, 22 May 2023 18:48:00 GMT

Use the Admission Rules feature of Workload Management. Go to Settings->Workload management. See https://docs.splunk.com/Documentation/Splunk/9.0.4/Workloads/AdmissionRules for details.

Re: Is there a way to restrict Splunk admin access to search for index=*?

Navanitha — Tue, 23 May 2023 09:08:30 GMT

I tried creating a Admission rule for the condition "index=* OR search_time_range=alltime" but looks like the setting is not getting applied. Users are still able to search for index=*. Does this work on Clustered environment or is there any additional steps I need to follow for cluster env? We have SH cluster.

Re: Is there a way to restrict Splunk admin access to search for index=*?

richgalloway — Tue, 23 May 2023 16:08:24 GMT

Yes, Admission Rules should work on a SHC. It make take a short time for the changes to propagate to the rest of the cluster, but it should work.

Re: Is there a way to restrict Splunk admin access to search for index=*?

Navanitha — Tue, 23 May 2023 17:50:42 GMT

It is not working. I did add/update workload_rules.conf on all our Splunk SH's in our cluster still no luck. Does it need any Splunk restart or do I have to assign it to users / roles just thinking loud.

This is what I have in workload_rules.conf under /opt/splunk/etc/apps/search/local

[search_filter_rule:WildcardSearch]
action = filter
predicate = index=* OR search_time_range=alltime
user_message = Please provide index name

Re: Is there a way to restrict Splunk admin access to search for index=*?

richgalloway — Tue, 23 May 2023 18:46:57 GMT

There's no need for a restart if you set up the Admission Rule using the GUI. If you edit the config file then a restart is necessary. The rule will apply to all users/roles unless the predicate says otherwise.

Re: Is there a way to restrict Splunk admin access to search for index=*?

isoutamo — Wed, 24 May 2023 09:55:44 GMT

stupid question, but have you enabled Admission Rules? This must do by that activation switch which said "Admission Rules Disabled". Click it and then you have here the text "Admission Rules Enabled". To be honest this is not a best way to told that this is not in use 😞

r. Ismo