Can I give access to one device's logs only instead of an entire index?

[aferone]

I'd like to create a role in Splunk that gives access to one device's logs only instead of an entire index.

Is this possible?

Thanks!

[jbsplunk · Accepted solution]

This level of granularity with regard to access is not possible. I would suggest that you set up the device in question to report only to a particular index with a props/transforms configuration change to route all of that data to a particular index so it is siloed from the rest of your data.

[aferone]

Thanks for the info!