topic Re: Is it possible restrict a user search by data values? in Splunk Search

Is it possible restrict a user search by data values?

hketer — Thu, 18 Apr 2019 11:25:49 GMT

Hey!

For example, if I have events contain different countries.
Is it possible to restrict users by specific values?
So they'll be able to search only specific country or more.

I know the is option to restrict by index, its not what I want.
Thank you!!

Re: Is it possible restrict a user search by data values?

mayurr98 — Thu, 18 Apr 2019 14:07:51 GMT

I do think if you can do it by a user, but we can definitely do it by Role and then you can assign the role to that specific user.

Go to Setting>>Access controls>>Roles
you can use specific search values or field value

for example,
1) "Canada" OR "Nepal" OR "America" OR ..

2) "Country=Canada" OR "Country=Nepal" OR "Country=America" OR ..

For more info read,
https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Addandeditroleswithauthorizeconf#Search_filter_format

Re: Is it possible restrict a user search by data values?

vishaltaneja070 — Thu, 18 Apr 2019 14:08:48 GMT

Hello @hketer

If there is field called countries, then you can restrict by search term in roles definition like County = "Australia".