We have a requirement, where a team wants to monitor system performance on some of their systems that report into Splunk.
I would like to provide them access to that data, but not let them see the performance metrics or stats from other systems that they do not control, or allow them to look at the security logs from that system.
In a situation like this, where all hosts of a particular OS (say Windows) log their data into a single index (index=windows), how can I allow this team to view only certain portions of the index that they are allowed access to ?
Best practice is to split data into different indexes based on different access requirements or retention requirements that you may have. Then, assign the user's role access to only the index with the data required.
You can not split access in one index, aside from using search filters. These are not 100% secure however, and can reduce performance significantly, so are not recommended.
Another option to consider is to create that user their own app with their own set of dashboards and form searches, if simply removing the option to easily freeform search is a possibility.