Role based Index restriction

[anirudhk]

Hi There,

I am having a Distributed Splunk setup with a Search Head and 2 Indexers. I have few roles setup(Integrated to AD) with in the system with a role associated with a particular Index (srchIndexesAllowed = "" and srchIndexesDefault = ""). But this doesn't actually restrict users from accessing other index if explicitly provided.

I would need this to be implemented in my Environment to have complete control. How can I achieve this.

Regards
Anirudh

[martin_mueller]

Make sure your roles aren't inheriting more lenient permissions from parent roles.

[anirudhk]

srchIndexesAllowed should Ideally have taken care of it. It the user being part of multiple group that caused this behaviour.