Can logs form a forwarder be restricted to be viewed by a set of users only?

[rgadepal]

Hi All,

I am looking to configure a sox app on splunk, so wanted to know if it is possible  to restrict a user/s to only view logs from a specific forwarder/s in the indexer?

Thanks!

Rahul Gadepalli

[gcusello]

Hi @rgadepal,

accesses to data in Splunk are managed at index level, in other words if you want that a group of users be the only that see some data, you have to send these data in one index and give to the group access grants to that index.

It isn't possible to give different grants to different parts of data in the same index.

So you have to send logs from the forwarders that you want to limit to an index (e.g. IndexB), and all the other logs to another index (e.g. IndexA).

than you have to give access to IndexA to User_Group_1 and User_Group_2 and access to IndexB only to User_Group_2.

In this way:

• User_Group_1 can see only IndexA
• User_Group_2 can see IndexA and IndexB.

Ciao.

Giuseppe