Splunk Enterprise Security

Share part of indexed data with other users

sssignals
Path Finder

Hi Splunk community

I have a set of data under an index. I want to share part but not all of the data under this indexed data with another user. Can this be done and how? Thanks in advance.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
Index access is based on role. If a role has access to an index then any user with that role has full access to the index. There is no foolproof way to deny access to some of the data in an index.
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
Index access is based on role. If a role has access to an index then any user with that role has full access to the index. There is no foolproof way to deny access to some of the data in an index.
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

sssignals
Path Finder

Thanks richgalloway

Tags (1)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!