RBAC for Splunk Apps

[pubuduhashan]

Hi,

Is it possible to create custom permission structure within Splunk Apps and integrate in Splunk User roles?

Use case :

Im developing a custom Splunk App using Splunk UI Toolkit. I need to restrict some features within the app based on Splunk custom user role they have been assigned to. 

Thank you. 

[gcusello · Accepted solution]

Hi @pubuduhashan,

if you're speaking of permit different access to  a dashboard or to an index to different roles , it's possible managing the grants to the single knwledge objects (dashboards, eventtypes, etc...).

If you want to give limited access to some fields extracted from the raw data in en index, you can give different grants to the field extractions but anyway the users with that role continue to have access to the raw data in the index and it isn't possible to restrict access to a part of an index because grants are managed for the full index.

In this case, you should copy only the information for the restricted roles in a different summary index (you don't pay additional license for this) and use this data for the restricted roles, but it's long to implement.

Ciao.

Giuseppe

[pubuduhashan]

Thanks for the prompt response! 🙂

[gcusello]

Hi @pubuduhashan ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉