Getting Data In

Filter / Mask / Anonymize raw data by role at search time

splunkreal
Motivator

Hello,

regarding filtering Splunk roles, we would like to only allow transforming commands (stats, timechart...) for users on a specific search head. This search head is not part of the cluster, only querying clustered indexers. The aim is to avoid specific users from accessing raw indexes data, only show statistics.

At the moment we use summary indexing in local index by scheduling reports with sistats or sitimechart but it's long and heavy to convert searches.

Thanks for your help.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal ,

you have two solutions to do this:

copy your data in a summary index, copying only the data you want to share and creating special dashboards to see these data.

Creating an app with dashboards with disabled access to the Search and Reporting dashboard.

I prefer the first solution.

Ciao.

Giuseppe

splunkreal
Motivator

Hi @gcusello we already use summary indexing with local index on that particular search head. Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal ,

I suppose that you have your summary indexes on the Indexers, not on Search Heads!

if not review this position, you can have the correct result centralizing summary indexes on the Indexers.

So, you already have all that you need for anonymizing data.

Let me know if I can help you more, otherwise, please accept one answer foer the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

splunkreal
Motivator

Hi @gcusello 

this works fine, you can see Stephen_Sorkin answer at https://community.splunk.com/t5/Getting-Data-In/Summary-indexing-on-a-search-head/m-p/34175 

Splunk expert told me I may test this : https://community.splunk.com/t5/Getting-Data-In/Search-time-Mask/td-p/14363

[mysourcetype]
EXTRACT-out = (?s)^(?:\<\d+\>)?(?<altraw>.*)
FIELDALIAS-raw = altraw as _raw

What do you think?

Thanks for your help!

* If this helps, please upvote or accept solution 🙂 *
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...