topic Re: Index Access in Splunk Search

Index Access

nikhilmehra79 — Mon, 28 Sep 2020 16:40:52 GMT

Hi,

I want to give access to my splunk customers users acccess to only specific imndexes and not main indexes.

I also want to restrict that they search on that specific index and not main index, so if i created an index called si_test - the user by default should search in si_test and have access to this index data only - is that possible?

Re: Index Access

lguinn2 — Wed, 21 May 2014 00:49:53 GMT

Absolutely!

This is set in the roles, under Access Controls. I recommend that you set up a new role and give it access to only the indexes that you want. Then assign the users to that role.

Do not use role inheritance unless you read the documentation and/or understand how access to indexes is inherited.

Re: Index Access

nikhilmehra79 — Wed, 21 May 2014 04:14:15 GMT

I actually tired that, my AD has a group called XYZ, it has 2 users.

I created a AD auth through splunk, user shows up and i assigned role to these users.

Role only give them priv to log in and search on index si_test and block index "main"

still when i log in as that user, i can search on events which are supposed to be main index, no idea why ?

I am at 6.0.3