Splunk Search

How do I add a Role Restriction Search Filter on a field available in only one index?

djacquens
Path Finder

Hi, 😉

I need to add a Role Restriction Search filter on a field which is only available in one index.
My problem is that I am not sure the proper way to force this restriction on only this index?

If I add a restriction like this

 

 

"field_name"="field_value"

 

it works fine for the index containing the value but the others indexes return nothing.

 

If I add a restriction like this:

 

((NOT "field_name"=* ) OR ( "field_name"="field_value"))

 

the result seems false.

Do you have an idea of the correct field to restrict this field?

Thanks, 😊

Regards,

David

 

0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

I would just go with = as it works.

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I assume that the intention is to allow search in that index where field_name exists only when field_name==field_value but allow all searches when searching other indices?  If this is correct, how about

(index::that_index AND field_name::field_value) OR index!=that_index
0 Karma

djacquens
Path Finder

Thank you very much @yuanliu !

The SPL you gave me works only for me if I replace the :: by =.

(index=that_index AND field_name=field_value) OR index!=that_index


I understand this is not recommended but I don't understand how to fix it?


Thank you again,

 

David

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I would just go with = as it works.

0 Karma

djacquens
Path Finder

Thank you very much @yuanliu  !!

 

Have a great day! 😉

David

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...