Splunk Search

How to restrict a user's search based on a lookup table?

bruceclarke
Contributor

Hi all,

I'm developing an app for use across different teams at my company. We have certain security restrictions about what logs each team can see. So, team A might be permissioned to see every log statement, while team B will only be allowed to see logs related to a certain server.

I have a lookup table that determines which servers each employee is permissioned to and I'd like to restrict their searches based on this. Does anyone know of a way I can do this?

Please note that all of these logs are going to the same index. They are all the same type of log, just a different server.

Thanks!

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

In authorize.conf, there is a setting: srchFilter = . This can also be done via the GUI Admin Manager. It takes a string of search to restrict searches. I did a preliminary test, and it worked. In that field, try this:

|rest /services/authentication/current-context | table username | lookup user_auths.csv user AS username OUTPUT host | table host | format "" "(" "OR" ")" "" ""

Replace "user_auths.csv" with your lookup name or filename. Update the "user" field to be whatever is listed in that csv.

View solution in original post

strive
Influencer

alacercogitatus
SplunkTrust
SplunkTrust

In authorize.conf, there is a setting: srchFilter = . This can also be done via the GUI Admin Manager. It takes a string of search to restrict searches. I did a preliminary test, and it worked. In that field, try this:

|rest /services/authentication/current-context | table username | lookup user_auths.csv user AS username OUTPUT host | table host | format "" "(" "OR" ")" "" ""

Replace "user_auths.csv" with your lookup name or filename. Update the "user" field to be whatever is listed in that csv.

somesoni2
SplunkTrust
SplunkTrust

Create a macro to get the filter to be used for host based on your lookup and then use this macro as search filter in the team's role definition.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...