Splunk Search

Customize splunk search app to index

manikdham
Path Finder

I want to customize splunk search app such that particular users have access to a particular index. at login one should make selection for app and that app should have indexing data of particular index. Any ideas how to do this?

0 Karma

sdaniels
Splunk Employee
Splunk Employee

You use roles to lock down access to indexes. IE you could create a role with access to only one index. Then you are able to give individual users that role. That means that if they come into the search app and try to search on other indexes, they will get nothing. At the app level you assign roles that can access an application. Hope this helps.

sowings
Splunk Employee
Splunk Employee

The "launcher" app that ships with Splunk provides quick access to a list of the known apps. Each of your own custom apps could then expressly only search in the target index. That is, the "search" part of any form view would include a search filter like "index=this_apps_index".

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...