indexaccess on appcontext basis

[TheEggi98]

Hi splunkers,

is it possible to restrict indexaccess to specific appcontext?

like a user has read access to app a and write access to app b
app a has dashboards on index a
inside app b has dashboards on index b but searching through index a is not allowed inside app b

because we have built a firewall selfservice, where people can check if their connection get blocked by firewall and if so, they can open a ticket by one click.

Now we encounter some usergroups that want to be able to search on their own in their own app.
With this, they currently could freely search and analyse our firewall data beyond checking if their connection gets blocked or not.

How can we achieve accesscontrol like this if its even possible?

Thanks in advance!

[isoutamo · Accepted solution]

Hi

this is not possible. Index access and app access are two separate "entities" in splunk. This is explained here quite well and this is the way how you should implement your RBAC access to splunk.

 https://conf.splunk.com/files/2023/slides/PLA1169B.pdf

r. Ismo

[TheEggi98]

I already expected this answer but hope dies last ^^