Splunk Search

How to build a srchFilter when two indexes are allowed?

Clovisa
Path Finder

Hello,

I am trying to build a role that would allow the users to access to two indexes (index1 and index2). The index1 has a field called parameter and I want the role to restrict search filter to parameter=value. But when I do this (see code below), I don't have access anymore to my index2. How could I avoid this ?

Thanks !

[role_test]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
importRoles = user
srchIndexesAllowed = index1, index2
srchIndexesDefault = index1
srchFilter = parameter=value
srchMaxTime = 0
0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

By applying a restrictive search you are limiting the data they can see to a subset of the index(es) the role can see. Since index2 does not have a parameter field, you are removing index2 from the scope for that role.

You will need to do an OR in the search so that it covers all of the data they can see. For example:

(index=index1 parameter=value) OR (index=index2)

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

By applying a restrictive search you are limiting the data they can see to a subset of the index(es) the role can see. Since index2 does not have a parameter field, you are removing index2 from the scope for that role.

You will need to do an OR in the search so that it covers all of the data they can see. For example:

(index=index1 parameter=value) OR (index=index2)

Clovisa
Path Finder

Perfect thanks 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...