Security

Restrict index access using Eventtype

santiagn
Path Finder

We have over 1000 users, we are using Active Directory, Mapping groups to Roles, and we have 100's of indexes. We need to restrict access to indexes due to sensitive data. Our plan is to use "roles" and restrict the role by Event types. Those Event Types will map to certain indexes using wildcards. The question is: a) is there a better way and b) will this negatively impact performance.

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

You could do that with the "Restrict Search terms" field within a role:

alt text

0 Karma

santiagn
Path Finder

will this affect performance at all? slower searches etc?

0 Karma

ddrillic
Ultra Champion

Our plan is to use "roles" and restrict the role by Event types.
How do you do that?

Eventtypes were designed for categorization - so it might be a good choice ; -)

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...