Security

Access to _internal index to user without providing him admin privileges

hemendralodhi
Contributor

Hello,

We have a requirement here where we need to provide access to user to _internal user so that he can run some query on that. We would like to give access to _internal index to user without admin privilege if possible.

Query: index=_internal tcpin_connections [search index=”Your Index name”| dedup host | fields host | rename host as sourceHost ] | stats values(sourceIp) by sourceHost

This query will extract the host name in your index, and search it against splunk metric index to output the Ip Address

Let me know how we can achieve this.

0 Karma
1 Solution

musskopf
Builder

I don't think the access to the "_internal" index requires Admin. You can define which index each Role can access. Have a look on the "Settings -> Access Control - > Roles" options.

View solution in original post

0 Karma

musskopf
Builder

I don't think the access to the "_internal" index requires Admin. You can define which index each Role can access. Have a look on the "Settings -> Access Control - > Roles" options.

View solution in original post

0 Karma

hemendralodhi
Contributor

Thanks,

I found out the role user belongs to and added _internal index in that.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!