Getting Data In

Is there a way to grant access to a specific index within an app's authorize.conf?

cee137
Explorer

I have index1, index2, and index 3. I want role_user to have access to all three within a specific app. Is there a way to do this?

In $SPLUNK_HOME/etc/system/local my authorize.conf has 

srchIndexesDefault: index1;index2
srchIndexesAllowed: index1;index2

 In $SPLUNK_HOME/etc/apps/myApp/local my authorize.conf has 

srchIndexesDefault: index1;index2;index3
srchIndexesAllowed: index1;index2;index3

Of course, this doesn't work. I understand /system/local wins this conflicting parameter fight. Is there anyway to grant the user role access to index3 within myApp? Or would I have to create a different role that inherits role_user and adds index3 access to achieve this? 

Thanks in advance.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Access to indexes is by role only, not by app.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Access to indexes is by role only, not by app.

---
If this reply helps you, Karma would be appreciated.
0 Karma

cee137
Explorer

Darn. Thanks for the concise response!

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...