Archive

How to build a srchFilter when two indexes are allowed?

Path Finder

Hello,

I am trying to build a role that would allow the users to access to two indexes (index1 and index2). The index1 has a field called parameter and I want the role to restrict search filter to parameter=value. But when I do this (see code below), I don't have access anymore to my index2. How could I avoid this ?

Thanks !

[role_test]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
importRoles = user
srchIndexesAllowed = index1, index2
srchIndexesDefault = index1
srchFilter = parameter=value
srchMaxTime = 0
0 Karma
1 Solution

Splunk Employee
Splunk Employee

By applying a restrictive search you are limiting the data they can see to a subset of the index(es) the role can see. Since index2 does not have a parameter field, you are removing index2 from the scope for that role.

You will need to do an OR in the search so that it covers all of the data they can see. For example:

(index=index1 parameter=value) OR (index=index2)

View solution in original post

Splunk Employee
Splunk Employee

By applying a restrictive search you are limiting the data they can see to a subset of the index(es) the role can see. Since index2 does not have a parameter field, you are removing index2 from the scope for that role.

You will need to do an OR in the search so that it covers all of the data they can see. For example:

(index=index1 parameter=value) OR (index=index2)

View solution in original post

Path Finder

Perfect thanks 🙂

0 Karma