All Apps and Add-ons

Can we restrict user market wise or region wise

bwniranjan
New Member

Can we restrict user market wise or region wise. We have a users who can see all the data now once he login. But, we are looking at the option to restrict them market wise or region wise.

Tags (1)
0 Karma

FrankVl
Ultra Champion

The only manageable way to do that is to split your data into regional indexes and then give the users access only to the indexes of their region. But that is easier said than done if you already have a bunch of indexes with data at the moment 🙂

0 Karma

bwniranjan
New Member

If I create new indexs, what we do with existing data in indexes? That data still be visible for them.

0 Karma

FrankVl
Ultra Champion

I guess you have a couple of options:
- delete the old data (rather drastic)
- restrict access to that data to a few privileged individuals just in case the old data is still needed
- leave it as is with everyone having access, until that old data ages out (perhaps add some monitoring on people querying those old indexes)
- export raw events and re-index it into the new indexes and then delete the old data (lot of work)

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...