Customize splunk search app to index

[manikdham]

I want to customize splunk search app such that particular users have access to a particular index. at login one should make selection for app and that app should have indexing data of particular index. Any ideas how to do this?

[sdaniels]

You use roles to lock down access to indexes. IE you could create a role with access to only one index. Then you are able to give individual users that role. That means that if they come into the search app and try to search on other indexes, they will get nothing. At the app level you assign roles that can access an application. Hope this helps.

[sowings]

The "launcher" app that ships with Splunk provides quick access to a list of the known apps. Each of your own custom apps could then expressly only search in the target index. That is, the "search" part of any form view would include a search filter like "index=this_apps_index".