Deployment Architecture

How to restrict user to certain indexes only?

Builder

We have peers added to search heads, but users are able to search all the indexes on the peers.
We want to restrict some users so that they can access only certain indexes.

Is it possible with enterprise version of 7.2.6 ?

0 Karma
1 Solution

Hi,

If you are not familiar with .conf, you can restrict access to indexes bases on user 'roles' and user account.
For this, you need to have admin access to modify other user accounts.

Goto Settings > Access Controls

To manage access on role level, goto Roles and select any role and at end of the page you can specify access to specific indexes.
To manage access by User, goto Users and select any user and specify the access to specific indexes.

Accept and upvote the answer if it helps.

happy splunking.........!!!

View solution in original post

Hi,

If you are not familiar with .conf, you can restrict access to indexes bases on user 'roles' and user account.
For this, you need to have admin access to modify other user accounts.

Goto Settings > Access Controls

To manage access on role level, goto Roles and select any role and at end of the page you can specify access to specific indexes.
To manage access by User, goto Users and select any user and specify the access to specific indexes.

Accept and upvote the answer if it helps.

happy splunking.........!!!

View solution in original post

Builder

Thank you Gaurav. Just another query,. Is it possible to restrict indexes by search head.
since this user could login to another search head and query the indexes. ( we do not have SH clustering )

0 Karma

I don't understand why you want the user to login to different search head to access different indexes.
I would suggest not to go for this kind of approach., you add all indexers as peers to single search head and restrict the access to indexes. If there are many users, go for search head clustering. It will be easy to maintain compared to multiple distributed search head.

However if you still want to, add some indexers as peers to one search head and others to second search head. In long run as indexes and user increases it will create a mess.

Please upvote the answer as well.

0 Karma

SplunkTrust
SplunkTrust

Hi,

I've recently answered a similiar issue (which was not the answer to the problem but it should be to your problem).
Searching indexes can be restricted by using authorize.conf (and in case of LDAP authentication.conf for group mappings). RBAC is possible. See this answer: https://answers.splunk.com/answers/760111/rbac-with-indexes.html#answer-759157

Additionally to my linked post, make sure to modify the user and poweruser role (copy the stanzas to a app/local/authorize.conf). Those roles are allowed to search all indexes by default.

Skalli

0 Karma