Knowledge Management

Is there a way to restrict Splunk admin access to search for index=*?

Navanitha
Path Finder

How to restrict access for a Splunk admin role from being able to run index="*" search.  This is killing our Splunk resources and need to restrict the access.  Apart from User awareness / Education, is there any way to implement this ?

Labels (1)
0 Karma

Navanitha
Path Finder

I tried creating a Admission rule for the condition "index=* OR search_time_range=alltime" but looks like the setting is not getting applied. Users are still able to search for index=*. Does this work on Clustered environment or is there any additional steps I need to follow for cluster env?  We have SH cluster.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, Admission Rules should work on a SHC.  It make take a short time for the changes to propagate to the rest of the cluster, but it should work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Navanitha
Path Finder

It is not working.  I did add/update workload_rules.conf on all our Splunk SH's in our cluster still no luck.  Does it need any Splunk restart or do I have to assign it to users / roles just thinking loud.

This is what I have in workload_rules.conf under /opt/splunk/etc/apps/search/local

 

[search_filter_rule:WildcardSearch]
action = filter
predicate = index=* OR search_time_range=alltime
user_message = Please provide index name

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's no need for a restart if you set up the Admission Rule using the GUI.  If you edit the config file then a restart is necessary.  The rule will apply to all users/roles unless the predicate says otherwise.

---
If this reply helps you, Karma would be appreciated.
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

stupid question, but have you enabled Admission Rules? This must do by that activation switch which said "Admission Rules Disabled". Click it and then you have here the text "Admission Rules Enabled". To be honest this is not a best way to told that this is not in use 😞

r. Ismo

richgalloway
SplunkTrust
SplunkTrust

Use the Admission Rules feature of Workload Management.  Go to Settings->Workload management.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Workloads/AdmissionRules for details.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...