Security

How to restrict the user to access part of data in an index not all data

gowthammahes
Path Finder

Hi,

There is an application which is used by multiple teams and we are ingesting the application logs for each team in a single index. Here we want to restrict each team people should be accessible only their teams logs not all the data in the index. How do i implement it in splunk?

Thanks in advance.

Gowtham

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could consider using summary indexes. Summary indexes do not count against your licence (they used prior to version 4)

Use summary indexing for increased search efficiency - Splunk Documentation

richgalloway
SplunkTrust
SplunkTrust

Access to data is by index.  If you grant a role access to an index then they have access to all of that index.  To control access, each team's application logs should be in separate indexes and each team given access only to the index containing their data.

You may be able to find a workaround using search filters.  Each team (role) would be configured with a search filter that only returns data pertinent to that team.  If you try this be aware that search filters can be bypassed and often have undesired side-effects.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...