Deployment Architecture

How to restrict user to certain indexes only?

jiaqya
Builder

We have peers added to search heads, but users are able to search all the indexes on the peers.
We want to restrict some users so that they can access only certain indexes.

Is it possible with enterprise version of 7.2.6 ?

0 Karma
1 Solution

gaurav_maniar
Builder

Hi,

If you are not familiar with .conf, you can restrict access to indexes bases on user 'roles' and user account.
For this, you need to have admin access to modify other user accounts.

Goto Settings > Access Controls

To manage access on role level, goto Roles and select any role and at end of the page you can specify access to specific indexes.
To manage access by User, goto Users and select any user and specify the access to specific indexes.

Accept and upvote the answer if it helps.

happy splunking.........!!!

View solution in original post

gaurav_maniar
Builder

Hi,

If you are not familiar with .conf, you can restrict access to indexes bases on user 'roles' and user account.
For this, you need to have admin access to modify other user accounts.

Goto Settings > Access Controls

To manage access on role level, goto Roles and select any role and at end of the page you can specify access to specific indexes.
To manage access by User, goto Users and select any user and specify the access to specific indexes.

Accept and upvote the answer if it helps.

happy splunking.........!!!

jiaqya
Builder

Thank you Gaurav. Just another query,. Is it possible to restrict indexes by search head.
since this user could login to another search head and query the indexes. ( we do not have SH clustering )

0 Karma

gaurav_maniar
Builder

I don't understand why you want the user to login to different search head to access different indexes.
I would suggest not to go for this kind of approach., you add all indexers as peers to single search head and restrict the access to indexes. If there are many users, go for search head clustering. It will be easy to maintain compared to multiple distributed search head.

However if you still want to, add some indexers as peers to one search head and others to second search head. In long run as indexes and user increases it will create a mess.

Please upvote the answer as well.

0 Karma

skalliger
SplunkTrust
SplunkTrust

Hi,

I've recently answered a similiar issue (which was not the answer to the problem but it should be to your problem).
Searching indexes can be restricted by using authorize.conf (and in case of LDAP authentication.conf for group mappings). RBAC is possible. See this answer: https://answers.splunk.com/answers/760111/rbac-with-indexes.html#answer-759157

Additionally to my linked post, make sure to modify the user and poweruser role (copy the stanzas to a app/local/authorize.conf). Those roles are allowed to search all indexes by default.

Skalli

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...