All Apps and Add-ons

How to receive and mask data from multiple TA for UNIX app?

varad_joshi
Communicator

I would like to know the best practices to mask the data in a particular scenario.

I have 2 applications hosted on 2 different Linux servers which are sending logs to Splunk. Both the application owners also want to send their server related logs to Splunk so we decided to install TA for UNIX on the application servers.

Both the TA for UNIX are not sending information to Splunk and logs are being viewed in Splunk app for UNIX on SH.

Which are are best way to mask server1's information to be viewed by users of server2?

Usually we restrict users on app and index level, however its is just one app (Splunk app for UNIX) so I was wondering different ways to mask.

Tags (2)
0 Karma

teekayx
Path Finder

If you don't have the option to use a separate index for each of these servers, then you can

  • assign source/host/sourcetype values differently for each server data inputs
  • define 2 new user roles (preferably inheriting default user role) and use the 'Restrict search terms' option to limit the roles capability to search only the particular server's data for each roles respectively. Example: "host=server1"

Hope this helps.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@varad_joshi - Your reference to the add-on/apps is unclear. Can you please confirm which add-ons or apps are you referring to in Splunkbase?

Splunk App for Unix and Linux, Splunk Add-on for Unix and Linux, or both? I just want to be sure your post is tagged properly for greater visibility. Thank you.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...