Security

Splunk multi-roles

malliniak_2
New Member

Hi

I have two roles:

Role A: Restriction to status=500
Role B: Restriction to status=440

User ABC need to have only access to this two status (500 and 440) and User QAZ to status 500.

I added role B to User QAZ and it's working and Role A and B to User ABC.

For User QAZ it's working but for user ABC it's not working.
User QAZ only see status 500 but User ABC see everything.

So one restriction for user is working but not two.

I can't do this in one Role status 500 and 400. I need to have two Roles.

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you create Role C: Restriction to (status=500) OR (status=440) ?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...