Search all indexes in app

[benhooper]

Is it possible to search only the indexes assigned to a specific app?

So far, the only recommendation I've been able to find is to restrict user roles but that doesn't work for our usage.

[gcusello]

hI @benhooper,

Sorry!

Splunk has an RBAC approach to access, in other words: access grants are managed at Role level and not at App level.

So, You can assign access to an index only to one or more Roles and not to an App.

At the same time, you can grant access to an app to a Role.

Ciao.

Giuseppe

[isoutamo]

Hi @benhooper 

as @gcusello said, all access has given an index level by user roles. Quite often indexes are defined on one "generic" app for all systems or even in etc/system/local/indexes.conf. 

What you could do, is granting access to both app and index to the same user role (group). Just define on 

https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Authorizeconf#authorize.conf.example

srchIndexesAllowed = index_a, index_b

for role_XX and then meta.local / meta.default same access to the role_XXX for App_XXX.

Be sure that you don't inherit any roles which already have some srchIndexesAllowed defined otherwise that role will get access to those indexes also.

r. Ismo

[benhooper]

Hi @gcusello and @isoutamo, 

Thanks for your input.

The reason I ask is because our analysts will use Splunk to monitor services for various clients (so they'll all need access to all indexes). To allow for that, we we planning to use a structure like this:

• Service  / app #1
  • Overview dashboard: Search queries starting with index=* ...
  • Client #1 dashboard: Search queries starting with index=client1 ...
  • Client #2 dashboard: Search queries starting with index=client2 ...
• Service / app #2
  • Overview dashboard: Search queries starting with index=* ...
  • Client #1 dashboard: Search queries starting with index=client1 ...
  • Client #2 dashboard: Search queries starting with index=client2 ...

Because the searches aren't restricted to each app / each app's indexes, I guess the results could contain unexpected data.

I suppose we could just change the index names to <app name>_<client name> or something and adjust the search queries appropriately but I was hoping for something more dynamic than that.

Thanks.

[gcusello]

Hi @benhooper,

I fear you must create a Role for each Client.

Ciao.

Giuseppe

[isoutamo]

Unfortunately if user has more than one role those settings are merged together 😞 This means that if you need several separate roles for individual analyst then he/she must have several accounts to splunk.

If it's possible I propose you to use prefix on every index which told to which customer it belongs. Anyhow it's not a good habit to make any queries without telling which index you want to use.

And if this is too late then second option is create macro / event type which contains those indexes which belongs to particular customer. Also lookups can used here. E.g. add own lookups / client or one big which contains client, index and then call those via macro.

r. Ismo

[benhooper · Accepted solution]

Thanks for the advice.

I found out that index-based searching support partial wildcards so we're going to name indexes <clientname>_<appname> and use searches index=*_<appname> which seems to work just how we want it.

[gcusello]

Hi @benhooper,

Good for you.

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated by all the contributors 😉