How to filter fields for specific user from a index?

[happylearning]

let's say i have 1 index and we have multiple users, i want to assign a role so that user A can only view 5 interesting fields from 50 interesting fields. 

[ITWhisperer]

Try creating a new (summary) index with just the five fields in for each event in the main index as assign it to the restricted role.

[gcusello]

Hi @happylearning,

it isn't possible because in Splunk information access is managed at index level, so it isn't possible to create a role that can view only a part of information.

You can solve your requirement in two ways:

Create a dashboard for each role that visualize only the requested fields blocking the access to full events.

Copy the information in dedicated summary indexes containing only the information for one role.

Ciao.

Giuseppe