Security

can we restrict the access in splunk

Explorer

Suppose i have 6 aws instances sending log to splunk and we have 3 user :
1st is admin can see all 6 instances
2nd is user1 can see only 2 specific instances
3nd is user2 can see only 2 specific instances

user 2 and 3 can only see which they are configured to.

how can we implement this??

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Put the logs from the restricted instances into separate indexes. Secure the indexes so 1st user can read all of them, but users 2 and 3 can only read their respective index.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Put the logs from the restricted instances into separate indexes. Secure the indexes so 1st user can read all of them, but users 2 and 3 can only read their respective index.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!