Security

Distributed Search and Roles

hartfoml
Motivator

I have a Search Head with three indexers setup in distributed search.

There is another team in our enterprise that has logs in there own indexer and out team has access to there search head using AD.

So that the team dose not have to use two windows to access the data from both sets of indexers I can setup distributed search to all the indexers just using different credentials for my indexers and for the other teams indexer.

The problem is that not everyone in my environment is allowed to see the logs from the other indexer. How can the admin of the other instance control access to the people on my search head?

0 Karma

somesoni2
Revered Legend

You can configure Roles to have access to specific indexes (assuming other team is using different index names then yours).

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

This is correct, and probably the best you can do. Just note that the administrator of the search head can still have access to all indexers data, as the role/index access is controlled and managed on the search head, not on the indexer.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...