Security

User able to see sources they don't have access to.

rmcdougal
Path Finder

I am attempting to setup user roles to restrict what user can see and I am having some trouble with the Search app. The user is only able to search the index that I allowed them access to, but on the search app they are able to see a summary of the data in the main index. Any idea why that would be?

Tags (1)
0 Karma

Drainy
Champion

If you are restricting indexes through search restrictions by default all users can see the main index. If you want to restrict access to this then you also need to add NOT index=main to your search restrictions. The summary is populated from the main index (as mike points out above), but if you don't restrict this then they will still see it.

0 Karma

mikelanghorst
Motivator

The summary page should only be showing data from their default searched indexes. Could you provide more details for which search or section of the summary page their seeing the data?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...