Filter / Mask / Anonymize raw data by role at search time

[splunkreal]

Hello,

regarding filtering Splunk roles, we would like to only allow transforming commands (stats, timechart...) for users on a specific search head. This search head is not part of the cluster, only querying clustered indexers. The aim is to avoid specific users from accessing raw indexes data, only show statistics.

At the moment we use summary indexing in local index by scheduling reports with sistats or sitimechart but it's long and heavy to convert searches.

Thanks for your help.

[gcusello]

Hi @splunkreal ,

you have two solutions to do this:

copy your data in a summary index, copying only the data you want to share and creating special dashboards to see these data.

Creating an app with dashboards with disabled access to the Search and Reporting dashboard.

I prefer the first solution.

Ciao.

Giuseppe

[splunkreal]

Hi @gcusello we already use summary indexing with local index on that particular search head. Thanks.

[gcusello]

Hi @splunkreal ,

I suppose that you have your summary indexes on the Indexers, not on Search Heads!

if not review this position, you can have the correct result centralizing summary indexes on the Indexers.

So, you already have all that you need for anonymizing data.

Let me know if I can help you more, otherwise, please accept one answer foer the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

[splunkreal]

Hi @gcusello 

this works fine, you can see Stephen_Sorkin answer at https://community.splunk.com/t5/Getting-Data-In/Summary-indexing-on-a-search-head/m-p/34175 

Splunk expert told me I may test this : https://community.splunk.com/t5/Getting-Data-In/Search-time-Mask/td-p/14363

[mysourcetype]
EXTRACT-out = (?s)^(?:\<\d+\>)?(?<altraw>.*)
FIELDALIAS-raw = altraw as _raw

What do you think?

Thanks for your help!