Security

User able to see sources they don't have access to.

rmcdougal
Path Finder

I am attempting to setup user roles to restrict what user can see and I am having some trouble with the Search app. The user is only able to search the index that I allowed them access to, but on the search app they are able to see a summary of the data in the main index. Any idea why that would be?

Tags (1)
0 Karma

Drainy
Champion

If you are restricting indexes through search restrictions by default all users can see the main index. If you want to restrict access to this then you also need to add NOT index=main to your search restrictions. The summary is populated from the main index (as mike points out above), but if you don't restrict this then they will still see it.

0 Karma

mikelanghorst
Motivator

The summary page should only be showing data from their default searched indexes. Could you provide more details for which search or section of the summary page their seeing the data?

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...