Security

Index view permission for admin user from one of search heads. Restrictions possible ?

highsplunker
Contributor

Hey guys, i have several search heads in my Splunk cluster. I'd like to restrict permissions for one particular search head (even for admins there). Is this possible?
Thanks in advance!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Access to indexes is controlled by role. The only way to restrict access from a given SH is to have separate roles on that SH that do not grant access to the restricted index. Since SHs in a cluster share configurations, the only way to have separate roles is to have an SH that is not part of the cluster. You'll need to create a new SH or split one off the cluster (assuming you currently have more than 3 in the cluster.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Kawtar
Path Finder

Hello @highsplunker

You should create roles if you want that in Access control.

richgalloway
SplunkTrust
SplunkTrust

Access to indexes is controlled by role. The only way to restrict access from a given SH is to have separate roles on that SH that do not grant access to the restricted index. Since SHs in a cluster share configurations, the only way to have separate roles is to have an SH that is not part of the cluster. You'll need to create a new SH or split one off the cluster (assuming you currently have more than 3 in the cluster.

---
If this reply helps you, an upvote would be appreciated.

highsplunker
Contributor

Ok! Thanks!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...