Creation of app for 3-4 indexes

[vishenps]

Hi, recently I was given a task to create an app for a specific dept. in my Org which will have only 2-3 selected indexes. 
Please guide me through high-level steps. 

[gcusello]

Hi @vishenps,

your question is just a little vague.

Let me understand: you have many indexes in your company and you want to create an app to permit to access to some of them (2 or 3) only to a restricted set of users, is this correct?

If this is your requirement, you could create a role for those users that can access only the selected indexes.

Then you can create some dashboards for those users or use the other dashboards, anyway, they will see only the data contained in the selected granted indexes.

Ciao.

Giuseppe

[isoutamo]

Hi

it's just like @gcusello said, you will need a role for that department users. For additional I propose that you will create an app for them also. In that way they can create own dashboards, reports etc. under that app and restrict access to those only for that app.

Here is one .conf presentation about how roles should/could defined for enterprises. https://conf.splunk.com/files/2023/slides/PLA1169B.pdf

r. Ismo