- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- How to restrict user to certain indexes only?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have peers added to search heads, but users are able to search all the indexes on the peers.
We want to restrict some users so that they can access only certain indexes.
Is it possible with enterprise version of 7.2.6 ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
If you are not familiar with .conf, you can restrict access to indexes bases on user 'roles' and user account.
For this, you need to have admin access to modify other user accounts.
Goto Settings > Access Controls
To manage access on role level, goto Roles and select any role and at end of the page you can specify access to specific indexes.
To manage access by User, goto Users and select any user and specify the access to specific indexes.
Accept and upvote the answer if it helps.
happy splunking.........!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
If you are not familiar with .conf, you can restrict access to indexes bases on user 'roles' and user account.
For this, you need to have admin access to modify other user accounts.
Goto Settings > Access Controls
To manage access on role level, goto Roles and select any role and at end of the page you can specify access to specific indexes.
To manage access by User, goto Users and select any user and specify the access to specific indexes.
Accept and upvote the answer if it helps.
happy splunking.........!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you Gaurav. Just another query,. Is it possible to restrict indexes by search head.
since this user could login to another search head and query the indexes. ( we do not have SH clustering )
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't understand why you want the user to login to different search head to access different indexes.
I would suggest not to go for this kind of approach., you add all indexers as peers to single search head and restrict the access to indexes. If there are many users, go for search head clustering. It will be easy to maintain compared to multiple distributed search head.
However if you still want to, add some indexers as peers to one search head and others to second search head. In long run as indexes and user increases it will create a mess.
Please upvote the answer as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I've recently answered a similiar issue (which was not the answer to the problem but it should be to your problem).
Searching indexes can be restricted by using authorize.conf (and in case of LDAP authentication.conf for group mappings). RBAC is possible. See this answer: https://answers.splunk.com/answers/760111/rbac-with-indexes.html#answer-759157
Additionally to my linked post, make sure to modify the user and poweruser role (copy the stanzas to a app/local/authorize.conf). Those roles are allowed to search all indexes by default.
Skalli
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
