Security

Index view permission for admin user from one of search heads. Restrictions possible ?

highsplunker
Contributor

Hey guys, i have several search heads in my Splunk cluster. I'd like to restrict permissions for one particular search head (even for admins there). Is this possible?
Thanks in advance!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Access to indexes is controlled by role. The only way to restrict access from a given SH is to have separate roles on that SH that do not grant access to the restricted index. Since SHs in a cluster share configurations, the only way to have separate roles is to have an SH that is not part of the cluster. You'll need to create a new SH or split one off the cluster (assuming you currently have more than 3 in the cluster.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Kawtar
Path Finder

Hello @highsplunker

You should create roles if you want that in Access control.

richgalloway
SplunkTrust
SplunkTrust

Access to indexes is controlled by role. The only way to restrict access from a given SH is to have separate roles on that SH that do not grant access to the restricted index. Since SHs in a cluster share configurations, the only way to have separate roles is to have an SH that is not part of the cluster. You'll need to create a new SH or split one off the cluster (assuming you currently have more than 3 in the cluster.

---
If this reply helps you, Karma would be appreciated.

highsplunker
Contributor

Ok! Thanks!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...