Deployment Architecture

Index rights

arkonner
Path Finder

A new index has been created by a splunk's user with admin rights - Only this user is able to use it; the other user with the same rights are unable to use it in a search - where these access rights should be granted in splunk.

Tags (2)
0 Karma

arkonner
Path Finder

This to confirm that the user is able to run a search using this index but not through a dashboard.

0 Karma

DennisMohn
Path Finder

Is the other user able to use the index by issuing the search command index=yourindexname?

You have to set the indices which are used by default via "Settings => Access controls => Roles => RoleName => Indexes searched by default"

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can specify which indexes are searchable by default to users via user roles and rights, based on user or group. See the docs :

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutusersandroles

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...