How to hide index data from users searches

[rayar]

Hi

I would like to make specific index data  invisible for all searches but not to actually delete it from the indexer and to keep all data integrations active 

is it possible  ? 

should I do with Role configuration  (Restrict search terms )   or there some other way   ?

If is am using role configuration , will the user see the data if he runs index=*   ?

thanks 

[scelikok · Accepted solution]

So, you can use Search Restriction like below;

index!=sensitive_index

It will filter all data from "sensitive_index" even on index=* searches.

[rayar]

Hi

Currently we are using as below  (All non-internal indexes  marked )

we don't want t change it since the indexes list is dynamic 

what you would suggest   ?

[scelikok]

Hi @rayar,

The best and safest way to restrict an index from user searches is specify searchable indexes from roles. You can find details in below document.

https://docs.splunk.com/Documentation/Splunk/8.1.1/Security/Addandeditroles#Specify_searchable_index... 

If this reply helps you an upvote is appreciated.