Deployment Architecture

How to create search for Multi-tenant?

Loves-to-Learn Lots

We are running Splunk ES and trying to make log search and app interfaces for each company. Let's call them CompanyA, CompanyB and CompanyC.Each company has to see its own data and also notable events in ES. As a holding company, we need to access and see all data. What is best way to achieve this goal? Please advise.

Labels (1)
Tags (1)
0 Karma


Hi @gmbdrj,

Enterprise Security isn't multi tenant!

You can use as a workaround, to store data of each customer in a different index, but anyway you have to:

  • create different indexes for each customer to identify them (it isn't a great job),
  • manually modify all the searches in Correlation Searches (it isn't a great job),
  • manually modify threat intelligence searches and inputs (very hard job!),
  • manually modify identities and assets (hard job!),
  • create specific dashboard for the customers because it isn't possible to modify the main ES dashboards (it isn't a great job).

I did it for some of our customers but it wasn't a simple job and I hint to engage Splunk Professional Services.



0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...