Getting Data In

Can logs form a forwarder be restricted to be viewed by a set of users only?

New Member

Hi All,


I am looking to configure a sox app on splunk, so wanted to know if it is possible  to restrict a user/s to only view logs from a specific forwarder/s in the indexer?


Rahul Gadepalli

Labels (1)
0 Karma


Hi @rgadepal,

accesses to data in Splunk are managed at index level, in other words if you want that a group of users be the only that see some data, you have to send these data in one index and give to the group access grants to that index.

It isn't possible to give different grants to different parts of data in the same index.

So you have to send logs from the forwarders that you want to limit to an index (e.g. IndexB), and all the other logs to another index (e.g. IndexA).

than you have to give access to IndexA to User_Group_1 and User_Group_2 and access to IndexB only to User_Group_2.

In this way:

  • User_Group_1 can see only IndexA
  • User_Group_2 can see IndexA and IndexB.



0 Karma
Get Updates on the Splunk Community!

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options A recent Tech Talk, ...

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...