Splunk Search

Anonymous users access to their data and view.

krantik
New Member

I am not sure if this is feasible and done before.

We have anonymous users, each have their own sensors which generate temperature and humidity. Can we setup splunk so that each users data can be sent and then displayed as line graph or ring graph. Each sensor has a unique id, and we can send the temp and humidity value along with it, can we display the view based on the sensor unique id?

Thank you in advance,

Tags (2)
0 Karma

renjith_nair
Legend

It depends what is "Anonymous" here? If the user wants to see the data, then he is not anonymous any more since they need username/password for splunk.

One of the recommended ways is to have separate index for each sensor or user and then send the data to respective indexes. The user then will be able to see only those indexes which he has access(controlled with roles). In this way, just one view should be enough to visualize the data.

If you, as an admin wants to see the data per sensor, you can create a drop down box with sensors listed and then write SPL with token enabled from this box.

If your requirement can not be implemented with the above options, please explain it detail and someone will be able to help

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

krantik
New Member

I have seen that we can create guest/read only logins. This would be fine for us.

Can the indexes be created dynamically based on sensor id? , can we pass the sensor id along with credentials and direct to a view with that particular index? In our system we have the data for all sensors, can we iframe the view and pass the credentials along with the sensor id to show the view?

We understand if someone gets hold of the sensor id for others they can see the view they don't own, it doesn't have to be secure for the first phase.

Is there a better approach in Splunk to authenticate using existing portals and dynamic sensors?

0 Karma

renjith_nair
Legend

Splunk needs an index to store the data and it should be available before you forward the data. To create index dynamically you need a program/logic other than forwarder in front of the indexer and then based on the event - create an index and then forward the index. For eg: one of your sensor data receiver module can do this if it can connect to splunk using splunk REST API and the roles can also be assigned

sensor data -> your receiver --->(sub process to create index based on sensor id) -> forward the data to indexer

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

krantik
New Member

Thank you Renjith, sounds like the thing we need to try. Do you have any example of the rest call to create the index dynamically?

0 Karma

renjith_nair
Legend

Reference :

docs.splunk.com/Documentation/Splunk/6.1.10/RESTAPI/RESTindex#POST_data.2Findexes
http://docs.splunk.com/Documentation/Splunk/6.4.0/RESTUM/RESTusing
http://docs.splunk.com/Documentation/Splunk/6.4.0/RESTUM/RESTusing

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...