Hello,
I've an index where all my data is stored and I want to create 2 savedsearch :
- one with all the data (i have to create this one because there are others sourcetype that i don't want the user to access).
- one with less data
I have an issue when i create my savedsearch with
|table myfield1,myfield2
i can see myfield3 in the events tab from the search result.
In fact, i want to see myfield3 from events tab only with my savedsearch with all the data but not in the other one.
Hi @ITWhisperer,
data access is controlled at index level, but you cannot give access to a user to a part of the index.
You can create dedicated dashboards that display only some fields, but you have also to block the access to the raw data (Open in search feature).
A good approach could be the one hinted by @ITWhisperer of creating a new Summary index with only a part of information for these users.
Ciao.
Giuseppe
Hi @ITWhisperer,
data access is controlled at index level, but you cannot give access to a user to a part of the index.
You can create dedicated dashboards that display only some fields, but you have also to block the access to the raw data (Open in search feature).
A good approach could be the one hinted by @ITWhisperer of creating a new Summary index with only a part of information for these users.
Ciao.
Giuseppe
I'll try to check that.
Thx
Hi @fatanyk,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉
The events tab shows the events from the initial search, before any transformation such as removing a field from the output of the search.
Instead, you could use a summary index to store the depleted events.