Access Controls

[sameer12sa]

Hi

Can we have configure users according to the monitors defined at the Universal Forwarder?
We are trying to have a splunk server which monitors mail server and weblogic logs. I am trying to create users who can only access mail server logs and another group which can only access weblogic logs.

Is there any way to do that?

Thanks
Sameer

[dwaddle]

The most robust approach is to put each different role's data into its own index. You'd have a "mail" index and a "weblogic" index, and each inputs.conf stanza would explicitly say index=<foo>. Then, you configure each role as to the index(es) it's allowed to use, and drop the users into the proper roles .... and Bob's your uncle.

[lpolo]

You can do it by defining the roles of each set of users in Splunk. More information:

http://docs.splunk.com/Documentation/Splunk/4.3.1/Admin/Aboutusersandroles

Manager » Access controls