How to allow a Splunk user to access only part of an index?

Path Finder

Hello All,

We have a requirement, where a team wants to monitor system performance on some of their systems that report into Splunk.

I would like to provide them access to that data, but not let them see the performance metrics or stats from other systems that they do not control, or allow them to look at the security logs from that system.

In a situation like this, where all hosts of a particular OS (say Windows) log their data into a single index (index=windows), how can I allow this team to view only certain portions of the index that they are allowed access to ?

Thanks and Regards,
Madan Sudhindra

0 Karma

Splunk Employee
Splunk Employee

You can move part of the original index data to a summary index with "collect" and assign permissions accordingly.

0 Karma


Best practice is to split data into different indexes based on different access requirements or retention requirements that you may have. Then, assign the user's role access to only the index with the data required.

You can not split access in one index, aside from using search filters. These are not 100% secure however, and can reduce performance significantly, so are not recommended.

Another option to consider is to create that user their own app with their own set of dashboards and form searches, if simply removing the option to easily freeform search is a possibility.

Community Manager
Community Manager

Hi @msudhindra

I've never had to do this myself, but from digging through documentation, you should be able to choose a particular index they can search and further filter access by adding search filters to their roles that pertain only to performance metrics data.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!