Different apps for different groups

[splunklearner]

currently we are on-boarded applications like 1,2,3,4..... 100 into default search and reporting app.

But we they belongs to different groups and we are in process of dividing each applications to designated group and create an app for it.

ABC group has 1,2,3..... 10 applications.

DEF group has 10,11.....40 applications.

So, what we are expecting is to create an app name called ABC and DEF and want all belonging apps to send into this apps (groups). 

As of now, we are restricting users based on their application index.

How to start with this requirement? like DEF app should not be visible and accessible to ABC app and vice versa. They should only see their app and their application logs.

[splunklearner]

We have different indexes and different roles created for different users. Now my question is can I create app and give access to specific group users? How to do that

1 application --- different index -- restricted to 1 app team

2 application -- different index -- restricted to 2 app team

now 1 and 2 apps belong to ABC group. Want to ABC as app and 1 and 2 app teams should have access to only ABC group and access their assigned 1 app logs or 2 app logs.

[gcusello]

Hi @splunklearner ,

you can create apps and give access to some Roles to each one.

But assigning apps to Roles you solve only part of the problem, because you have also to assign data access to the Roles and you can do this in [Settings > Roles].

At least, you have to associate your groups to Roles: Roles drive the access policies, Users are associated to access grants throgh Roles.

Ciao.

Giuseppe

[gcusello]

Hi @splunklearner ,

access grants, in Splunk, are managed at index level, have you all these data in different indexes or all in the same index?

if in different indexes, you can enable each group of users (identified by a proper role) to access one index, then you can also use the same app, but users can see only the indexes enabled for them.

In [Settings > Roles > Indexes] you can define for each role the enabled indexes.

If they are in the same index is more difficoult: you could try to create a rule, at role level, to access only events that match a rule (e.g. applications from 1 to 10), but it's more difficoult to manage the exceptions.

In [Settings > Roles > Restrictions] you can define the filters for that role. 

Ciao.

Giuseppe