How to allow users to view some search results from an index in a dashboard, without allowing them to search the index?

[gwalford]

There is a lot of useful detail in the index=wineventlog. I would like to be able to allow my front tier service desk access to dashboards that show things such as "user accounts locked out" or "print job failed".

However, I don't want them to have any access to the wineventlog index itself.

Is there a way of generating a report off of one index say, and moving the results to a separate index so that they don't gain access to the remainder of the information in the index?

[Jeremiah]

You have a couple of ways to implement this.

To answer your initial question, yes, you could use summary indexing to copy (not move) events from one index into another. That is not the original intent of summary indexing, but you could certainly have a scheduled search pick out the events you want to expose to your help desk and "summarize" them into another index. That would work best if you had a small number of events that you wanted to expose.

http://docs.splunk.com/Documentation/Splunk/6.3.2/Knowledge/Usesummaryindexing

Another option would be to create the dashboard using saved searches, and have those searches run as the owner, who has access to the index. Then your users can access the dashboard, view the results of the search without needing access to the underlying index.

See the section "Determine whether the search should run as Owner or run as User" in the following link:

http://docs.splunk.com/Documentation/Splunk/latest/Report/Createandeditreports

You can also restrict your user's access by adding a search expression to their role. This will allow you to give them access to the wineventlog index, but they effectively would only be able to see certain events as specified by the role search expression.

https://docs.splunk.com/Splexicon:Searchfilter