Splunk Search

How do I add a Role Restriction Search Filter on a field available in only one index?

djacquens
Path Finder

Hi, 😉

I need to add a Role Restriction Search filter on a field which is only available in one index.
My problem is that I am not sure the proper way to force this restriction on only this index?

If I add a restriction like this

 

 

"field_name"="field_value"

 

it works fine for the index containing the value but the others indexes return nothing.

 

If I add a restriction like this:

 

((NOT "field_name"=* ) OR ( "field_name"="field_value"))

 

the result seems false.

Do you have an idea of the correct field to restrict this field?

Thanks, 😊

Regards,

David

 

0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

I would just go with = as it works.

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I assume that the intention is to allow search in that index where field_name exists only when field_name==field_value but allow all searches when searching other indices?  If this is correct, how about

(index::that_index AND field_name::field_value) OR index!=that_index
0 Karma

djacquens
Path Finder

Thank you very much @yuanliu !

The SPL you gave me works only for me if I replace the :: by =.

(index=that_index AND field_name=field_value) OR index!=that_index


I understand this is not recommended but I don't understand how to fix it?


Thank you again,

 

David

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I would just go with = as it works.

0 Karma

djacquens
Path Finder

Thank you very much @yuanliu  !!

 

Have a great day! 😉

David

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...