How to allow a Splunk user to access only part of an index?

[msudhindra]

Hello All,

We have a requirement, where a team wants to monitor system performance on some of their systems that report into Splunk.

I would like to provide them access to that data, but not let them see the performance metrics or stats from other systems that they do not control, or allow them to look at the security logs from that system.

In a situation like this, where all hosts of a particular OS (say Windows) log their data into a single index (index=windows), how can I allow this team to view only certain portions of the index that they are allowed access to ?

Thanks and Regards,
Madan Sudhindra

[jhidalgo_splunk]

You can move part of the original index data to a summary index with "collect" and assign permissions accordingly.

[Jason]

Best practice is to split data into different indexes based on different access requirements or retention requirements that you may have. Then, assign the user's role access to only the index with the data required.

You can not split access in one index, aside from using search filters. These are not 100% secure however, and can reduce performance significantly, so are not recommended.

Another option to consider is to create that user their own app with their own set of dashboards and form searches, if simply removing the option to easily freeform search is a possibility.

[ppablo]

Hi @msudhindra

I've never had to do this myself, but from digging through documentation, you should be able to choose a particular index they can search and further filter access by adding search filters to their roles that pertain only to performance metrics data.
http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Addandeditroles#Search_filter_format