Getting Data In

Filter / Mask / Anonymize raw data by role at search time

splunkreal
Motivator

Hello,

regarding filtering Splunk roles, we would like to only allow transforming commands (stats, timechart...) for users on a specific search head. This search head is not part of the cluster, only querying clustered indexers. The aim is to avoid specific users from accessing raw indexes data, only show statistics.

At the moment we use summary indexing in local index by scheduling reports with sistats or sitimechart but it's long and heavy to convert searches.

Thanks for your help.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal ,

you have two solutions to do this:

copy your data in a summary index, copying only the data you want to share and creating special dashboards to see these data.

Creating an app with dashboards with disabled access to the Search and Reporting dashboard.

I prefer the first solution.

Ciao.

Giuseppe

splunkreal
Motivator

Hi @gcusello we already use summary indexing with local index on that particular search head. Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkreal ,

I suppose that you have your summary indexes on the Indexers, not on Search Heads!

if not review this position, you can have the correct result centralizing summary indexes on the Indexers.

So, you already have all that you need for anonymizing data.

Let me know if I can help you more, otherwise, please accept one answer foer the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

splunkreal
Motivator

Hi @gcusello 

this works fine, you can see Stephen_Sorkin answer at https://community.splunk.com/t5/Getting-Data-In/Summary-indexing-on-a-search-head/m-p/34175 

Splunk expert told me I may test this : https://community.splunk.com/t5/Getting-Data-In/Search-time-Mask/td-p/14363

[mysourcetype]
EXTRACT-out = (?s)^(?:\<\d+\>)?(?<altraw>.*)
FIELDALIAS-raw = altraw as _raw

What do you think?

Thanks for your help!

* If this helps, please upvote or accept solution 🙂 *
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...