Deployment Architecture

How to create search for Multi-tenant?

Loves-to-Learn Lots

We are running Splunk ES and trying to make log search and app interfaces for each company. Let's call them CompanyA, CompanyB and CompanyC.Each company has to see its own data and also notable events in ES. As a holding company, we need to access and see all data. What is best way to achieve this goal? Please advise.

Labels (1)
Tags (1)
0 Karma


Hi @gmbdrj,

Enterprise Security isn't multi tenant!

You can use as a workaround, to store data of each customer in a different index, but anyway you have to:

  • create different indexes for each customer to identify them (it isn't a great job),
  • manually modify all the searches in Correlation Searches (it isn't a great job),
  • manually modify threat intelligence searches and inputs (very hard job!),
  • manually modify identities and assets (hard job!),
  • create specific dashboard for the customers because it isn't possible to modify the main ES dashboards (it isn't a great job).

I did it for some of our customers but it wasn't a simple job and I hint to engage Splunk Professional Services.



0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...