How to use lookup field in roles

Security

Hi,

I'm trying to add splunk access to a user.

I have a search which creates lookup with hosts names. It is created based on IP from _internal logs - I have a list of IP ranges.

Now I wanted to created a role, with restrictions to hosts from lookup.

I've tried to create a event type, but I can't use pipes there, to read lookup.

I've also tried to use inputlookup command in role restrictions, but no luck.

Any Idea how to do it? Maybe other way, without lookup?

Get Updates on the Splunk Community!

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering. Because we’ve ...

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...

Are you a member of the Splunk Community?