How to masking data by Role-based on Splunk Cloud?

[yottanat2021]

I want to masking data by Role-based on Splunk Cloud.

[yottanat2021]

Hi @gcusello,

Thank your for reply.

I want to masking data at search-time on Splunk Cloud.

Example like this:

[1] Enable role-based field filtering feature
file: /opt/splunk/etc/system/local/limits.conf
#
[search]
role_based_field_filtering = true

[2] Config field filtering for user role (not support on UI, manual edit only), example role name is "staff"
file: /opt/splunk/etc/system/local/authorize.conf
#
[role_staff]
fieldFilter-host = SHA256
fieldFilter-_raw = s/output_mode=[^ ']+/output_mode=HIDDEN/g
fieldFilterLimit = sourcetype::audittrail
importRoles = user

[gcusello · Accepted solution]

Hi @yottanat2021,

for my knowledge, it isn't possible to mask data at search time.

You can block the access to the row data, disabling the open in search feature in all the dashboards enabled for that role, and permit only access to some dashboards with a subset of fields.

This means that you must create different dashboards for each role!

Access to data is managed in Splunk at index level, in other words, if a role is enabled to see the events stored in an index, it can see all the data,

but, as I said, you can only block the access to the raw data and permit access to data only using a limited dashboard.

Ciao.

Giuseppe

[yottanat2021]

Hi @gcusello,

Thank you for your guidance help me so much. 😀

[gcusello]

Hi @yottanat2021,

could you better describe your requirement?

are you speaking of data masking at index time or at search time?

Ciao.

Giuseppe