Splunk Search

How to restrict search access to certain hosts or fields on a per-user basis?

jhillenburg
Path Finder

Hello. I'm new to Splunk. This may become obvious with my next question: I would like to restrict access to certain hosts or fields on a per-user basis. IE. I might want our Help Desk to not be able to access the logs for a certain server, or I may want to give them access to data for a given server but not be able to view a particular field. What methods have people used for this? Thanks.

1 Solution

yannK
Splunk Employee
Splunk Employee

"I might want our Help Desk to not be able to access the logs for a certain server"

This is easy, if you segment your data per index and use the roles to control the access.
This is also an unbreakable method.
example in the inputs specify the index, and use 2 versions of each index one public, one private, and use a wildcard in your searches.

Example : with the indexes database-public and database-secure
use a search like index=database-*

"I may want to give them access to data for a given server but not be able to view a particular field"

This is the hard part, the only solution that splunk propose is a the role search limits, by adding a mandatory search condition.

By example :
for the RoleA, always add "AND host!=securehost" to the main search conditions.

View solution in original post

tedwroks
Explorer

Is it possible:

  1. use a report and give access to the role/user you want to restrict access.
  2. have this report run using the owner (who has access to the event/fields).
  3. the report returns a table with only the fields that should be accessible to the user/role.
  4. remove access to the event/index for the user/role

In a way, this is using reports (or a data model) to give access to something, even though the underlying events/index is not accessible by the user/role.

0 Karma

ppablo
Community Manager
Community Manager

Hi @jhillenburg

Just following up, but did @aljohnson_splunk or @yannK's answers help solve your question? If yes, be sure to accept the appropriate answer by clicking on "Accept" below the response. If you're still having issues, it'd be great if you could comment on the answers below to to find the answers and resolve this post. Thanks!

Patrick

0 Karma

yannK
Splunk Employee
Splunk Employee

"I might want our Help Desk to not be able to access the logs for a certain server"

This is easy, if you segment your data per index and use the roles to control the access.
This is also an unbreakable method.
example in the inputs specify the index, and use 2 versions of each index one public, one private, and use a wildcard in your searches.

Example : with the indexes database-public and database-secure
use a search like index=database-*

"I may want to give them access to data for a given server but not be able to view a particular field"

This is the hard part, the only solution that splunk propose is a the role search limits, by adding a mandatory search condition.

By example :
for the RoleA, always add "AND host!=securehost" to the main search conditions.

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!