How to create search for Multi-tenant?

[gmbdrj]

We are running Splunk ES and trying to make log search and app interfaces for each company. Let's call them CompanyA, CompanyB and CompanyC.Each company has to see its own data and also notable events in ES. As a holding company, we need to access and see all data. What is best way to achieve this goal? Please advise.

[gcusello]

Hi @gmbdrj,

Enterprise Security isn't multi tenant!

You can use as a workaround, to store data of each customer in a different index, but anyway you have to:

• create different indexes for each customer to identify them (it isn't a great job),
• manually modify all the searches in Correlation Searches (it isn't a great job),
• manually modify threat intelligence searches and inputs (very hard job!),
• manually modify identities and assets (hard job!),
• create specific dashboard for the customers because it isn't possible to modify the main ES dashboards (it isn't a great job).

I did it for some of our customers but it wasn't a simple job and I hint to engage Splunk Professional Services.

Ciao.

Giuseppe