Share part of indexed data with other users

[sssignals]

Hi Splunk community

I have a set of data under an index. I want to share part but not all of the data under this indexed data with another user. Can this be done and how? Thanks in advance.

[richgalloway · Accepted solution]

Index access is based on role. If a role has access to an index then any user with that role has full access to the index. There is no foolproof way to deny access to some of the data in an index.

[sssignals]

Thanks richgalloway