Is there a way to restrict Splunk admin access to search for index=*?

[Navanitha]

How to restrict access for a Splunk admin role from being able to run index="*" search.  This is killing our Splunk resources and need to restrict the access.  Apart from User awareness / Education, is there any way to implement this ?

[Navanitha]

I tried creating a Admission rule for the condition "index=* OR search_time_range=alltime" but looks like the setting is not getting applied. Users are still able to search for index=*. Does this work on Clustered environment or is there any additional steps I need to follow for cluster env?  We have SH cluster.

[richgalloway]

Yes, Admission Rules should work on a SHC.  It make take a short time for the changes to propagate to the rest of the cluster, but it should work.

[Navanitha]

It is not working.  I did add/update workload_rules.conf on all our Splunk SH's in our cluster still no luck.  Does it need any Splunk restart or do I have to assign it to users / roles just thinking loud.

This is what I have in workload_rules.conf under /opt/splunk/etc/apps/search/local

[search_filter_rule:WildcardSearch]
action = filter
predicate = index=* OR search_time_range=alltime
user_message = Please provide index name

[richgalloway]

There's no need for a restart if you set up the Admission Rule using the GUI.  If you edit the config file then a restart is necessary.  The rule will apply to all users/roles unless the predicate says otherwise.

[isoutamo]

Hi

stupid question, but have you enabled Admission Rules? This must do by that activation switch which said "Admission Rules Disabled". Click it and then you have here the text "Admission Rules Enabled". To be honest this is not a best way to told that this is not in use 😞

r. Ismo

[richgalloway]

Use the Admission Rules feature of Workload Management.  Go to Settings->Workload management.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Workloads/AdmissionRules for details.