How to configure User access based on index

[Gowthamdevaraj]

Hi,

I want to set up various user roles to users in my splunk instances. Like Users from Group A should only have access to index A and So on. I tried
1. creating a new role called UserGroupA and add the index A to the role and adding the inherited parent as user role.
2. Cloned user role and restrict the index to index A. but none of this worked for me.

Note: But if I restrict indexes to the role User without any additional roles added, then it's working. But my use case is to set up multiple roles based on index and allow users to access only the index results and dashboards.

Did I miss something?

Thanks.

[solarboyz1]

The recommended method:

1. Clone the User Role, and rename as UserGroupA
2. Modify UserGroupA allowed indexes, and ensure the role does not inherit any other roles.
   
3. Assign the role to a user and verify.

https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/Aboutusersandroles#How_users_inherit_all...

If this isn't working, I would first verify the roles assigned to the user:

|rest /services/authentication/users splunk_server=local 
 |fields title roles realname|rename title as userName|rename realname as Name

Ensure the user doesnt have additional roles assigned that may be allowing the user access to the index.

Next, verify the indexes that a role is given access to...both configured and inherited:

 | rest /servicesNS/nobody/system/admin/roles splunk_server=local
 | rename title as roles
 | eval idx=mvjoin(srchIndexesAllowed," ")
 | eval iidx=mvjoin(imported_srchIndexesAllowed, " ")
 | table roles idx, iidx