topic Re: How to filter fields for specific user from a index? in Splunk Search

How to filter fields for specific user from a index?

happylearning — Wed, 17 May 2023 11:32:31 GMT

let's say i have 1 index and we have multiple users, i want to assign a role so that user A can only view 5 interesting fields from 50 interesting fields.

Re: How to filter fields for specific user from a index?

gcusello — Wed, 17 May 2023 11:34:47 GMT

Hi @happylearning,

it isn't possible because in Splunk information access is managed at index level, so it isn't possible to create a role that can view only a part of information.

You can solve your requirement in two ways:

Create a dashboard for each role that visualize only the requested fields blocking the access to full events.

Copy the information in dedicated summary indexes containing only the information for one role.

Ciao.

Giuseppe

Re: How to filter fields for specific user from a index?

ITWhisperer — Wed, 17 May 2023 11:34:52 GMT

Try creating a new (summary) index with just the five fields in for each event in the main index as assign it to the restricted role.