Splunk Enterprise Security

Share part of indexed data with other users

sssignals
Path Finder

Hi Splunk community

I have a set of data under an index. I want to share part but not all of the data under this indexed data with another user. Can this be done and how? Thanks in advance.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
Index access is based on role. If a role has access to an index then any user with that role has full access to the index. There is no foolproof way to deny access to some of the data in an index.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
Index access is based on role. If a role has access to an index then any user with that role has full access to the index. There is no foolproof way to deny access to some of the data in an index.
---
If this reply helps you, Karma would be appreciated.

sssignals
Path Finder

Thanks richgalloway

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...