Security
Highlighted

Access to _internal index to user without providing him admin privileges

Contributor

Hello,

We have a requirement here where we need to provide access to user to _internal user so that he can run some query on that. We would like to give access to _internal index to user without admin privilege if possible.

Query: index=internal tcpinconnections [search index=”Your Index name”| dedup host | fields host | rename host as sourceHost ] | stats values(sourceIp) by sourceHost

This query will extract the host name in your index, and search it against splunk metric index to output the Ip Address

Let me know how we can achieve this.

0 Karma
Highlighted

Re: Access to _internal index to user without providing him admin privileges

Builder

I don't think the access to the "_internal" index requires Admin. You can define which index each Role can access. Have a look on the "Settings -> Access Control - > Roles" options.

View solution in original post

0 Karma
Highlighted

Re: Access to _internal index to user without providing him admin privileges

Contributor

Thanks,

I found out the role user belongs to and added _internal index in that.

0 Karma