Splunk Search

Can I specify app name in Splunk query and run that query from any app ?

VS0909
Communicator

Can I specify app name in Splunk query and run that query from any app ?

0 Karma

VS0909
Communicator

@gcusello  Thanks for the reply!

If I query index="abc" for app1 and app2, will I receive same events?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @VS0909,

if you use a search like index=abc, you'll receive the same events, it's different if you use in that search a field or an eventtype or a tag that are defined in the App and have their own access rights.

In other words, as I said in my previous answer, you have to set as Global App and Knowledge Objects, and give the same access rights than the App not only to the App but also to the knowledge objects (e.f. field extractions or eventtypes or tags) that it contains.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @VS0909,

for my knowledge you cannot.

You can configure access rights to an App and related Knowledge Objects as Global, giving access rights to one or more roles and the users with those roles can access the App and the K.O. without specifying the App that contains a search.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...