Different applications need to access all Splunk logs

[splunklearner]

Hello all,

Consider we have X application requested on-boarding on to Splunk. Created index for this X application, a new role (restricted to X index) and assigned this role to X AD group. Likewise we have Y, Z soon application. We do in the same manner.

But now the requirement is this X,Y,Z application come under 'A' applications and they want all 'A' team members (probably X,Y,Z combined) to view X,Y,Z applications.

How we can achieve this?

Can't create single index for all X,Y, and Z application because the logs should not be mixed.

[gcusello]

Hi @splunklearner ,

access grants are managed in Splunk at index level, so the best approach is to create different indexes for different grants.

Otherwise, you can put all the events in the same index and, when you create roles, you out a filter for each one, e.g. one role can see only events in index X with sourcetype A or source B.

Ciao.

Giuseppe