I would like to know the best practices to mask the data in a particular scenario.
I have 2 applications hosted on 2 different Linux servers which are sending logs to Splunk. Both the application owners also want to send their server related logs to Splunk so we decided to install TA for UNIX on the application servers.
Both the TA for UNIX are not sending information to Splunk and logs are being viewed in Splunk app for UNIX on SH.
Which are are best way to mask server1's information to be viewed by users of server2?
Usually we restrict users on app and index level, however its is just one app (Splunk app for UNIX) so I was wondering different ways to mask.
If you don't have the option to use a separate index for each of these servers, then you can
assign source/host/sourcetype values differently for each server data inputs
define 2 new user roles (preferably inheriting default user role) and use the 'Restrict search terms' option to limit the roles capability to search only the particular server's data for each roles respectively.