topic Index restriction not working with search head and search peers in Splunk Search

Index restriction not working with search head and search peers

takn4granted — Tue, 08 Oct 2013 14:09:35 GMT

We have 1 search head with 2 search peers. We have numerous indexes defined on the search peers, for example index A, B on the first peer and index C, D on the second peer. Using the search head we are able to search all the indexes as expected. We want to have our users perform all searches from the search head, however, when we define roles on our search head we are we are unable to see the remote indexes (index A,B,C,D) and thereby unable to restrict those indexes from any roles. Only the local indexes are showing within the Roles configuration screen.

what is the proper way to restrict users from searching those remote indexes?

Re: Index restriction not working with search head and search peers

dwaddle — Tue, 08 Oct 2013 21:49:00 GMT

Define the indexes on the search head - even if they are entirely empty, this is okay. That will make them appear in the manager UI on the search head so you can establish roles as needed.

Re: Index restriction not working with search head and search peers

chimbudp — Tue, 07 Jan 2014 02:58:58 GMT

Hi bro,

While creating new roles , please carefully add indexes to be searched/restricted for that particular role,
Later assign that role to any user and you test.

Goto ,

Manager » Access controls » Roles »

Indexes searched by default:(Set the index(es) that searches default to when no index is specified. User with this role can search other indexes using index= (e.g., "index=special_index").)

Indexes :(Restrict this role's searches to the specified index(es). Search results for this role will only show events from these indexes.)