Restrict Users to Search Specific Indexes

[IRHM73]

Hi, I wonder whether someone could help me please.

I have a number of teams who have Splunk apps which contain the 'search' functionality, with each app allocated it's own role which in turn, we assign to users.

I'm now wanting to allocate the roles to specific indexes for the purpose of increased efficiency and security which I'm comfortable and able to do.

I'm told, that although the 'search' function is a link within the app, I'm not able to restrict the indexes via the role to prevent users being able to search indexes not pertinent to the user.

Could someone please confirm for me whether this is correct or not?

Many thanks and kind regards

Chris

[renjith_nair · Accepted solution]

You can restrict a role to search only specific indexes

Settings  » Access controls » Roles »

Edit the role and you can set which indexes can be accessed by this role by setting the values under

Indexes

Restrict this role's searches to the specified index(es). Search results for this role will only show events from these indexes.

Check step 7 in https://docs.splunk.com/Documentation/Splunk/6.5.1/Security/Addandeditroles#Add_or_edit_a_role

[IRHM73]

Hi @renjith.nair, thank you for coming back to me with this.

Just to be absolutely sure. If a user uses the search window to type in a 'raw' search they can only do so on the indexes assigned to the role?

Many thanks and kind regards

Chris

[renjith_nair]

Hello Chris,

If an index is assigned to the role under "Selected search indexes", then all the users associated under the role can only access that particular index unless you have another role which has other indexes. If you have more than one role assigned to a user, then it will be a union of all indexes of all roles.

[IRHM73]

Hi @renjith.nair.

Many thanks for the confirmation.

Kind Regards

Chris