Security

Best way to segregate hosts

romainbouajila
Path Finder

Dear all,

I'm in the process of grouping hosts by location. I would like it to be based on the hostname.

The goal is to limit users and show them only logs they're supposed to have access to.

I managed to add a tag to an event type, and then I discovered it is possible to add metadata to events.

Is it possible to segregate access this way too ? What is the best practice for this ?

Thanks in advance

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @romainbouajila,

in Splunk access to data is managed only at index level, so if you want to segregate access to logs of a group of hosts, you have to put the logs from these servers in a dedicated index, so you can enable only one or more roles to access this index.

You can do this in two ways:

  • creating different TAs for each group and in each inputs.conf you put the name od the related index,
  • overrideng the index on the Indexers (or eventually on Heavy Forwarders if present) using props.conf and transforms.conf.

To override index on Indexers, you have to create:

props.conf

[host::yourhost]
TRANSFORMS-override_host = override_host 

transforms.conf

[override_host]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = your_host

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @romainbouajila,

in Splunk access to data is managed only at index level, so if you want to segregate access to logs of a group of hosts, you have to put the logs from these servers in a dedicated index, so you can enable only one or more roles to access this index.

You can do this in two ways:

  • creating different TAs for each group and in each inputs.conf you put the name od the related index,
  • overrideng the index on the Indexers (or eventually on Heavy Forwarders if present) using props.conf and transforms.conf.

To override index on Indexers, you have to create:

props.conf

[host::yourhost]
TRANSFORMS-override_host = override_host 

transforms.conf

[override_host]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = your_host

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @romainbouajila,

good for You.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...