Access to _internal index to user without providing him admin privileges

[hemendralodhi]

Hello,

We have a requirement here where we need to provide access to user to _internal user so that he can run some query on that. We would like to give access to _internal index to user without admin privilege if possible.

Query: index=_internal tcpin_connections [search index=”Your Index name”| dedup host | fields host | rename host as sourceHost ] | stats values(sourceIp) by sourceHost

This query will extract the host name in your index, and search it against splunk metric index to output the Ip Address

Let me know how we can achieve this.

[musskopf · Accepted solution]

I don't think the access to the "_internal" index requires Admin. You can define which index each Role can access. Have a look on the "Settings -> Access Control - > Roles" options.

[hemendralodhi]

Thanks,

I found out the role user belongs to and added _internal index in that.