How to restrict search access to certain hosts or fields on a per-user basis?

[jhillenburg]

Hello. I'm new to Splunk. This may become obvious with my next question: I would like to restrict access to certain hosts or fields on a per-user basis. IE. I might want our Help Desk to not be able to access the logs for a certain server, or I may want to give them access to data for a given server but not be able to view a particular field. What methods have people used for this? Thanks.

[tedwroks]

Is it possible:

1. use a report and give access to the role/user you want to restrict access.
2. have this report run using the owner (who has access to the event/fields).
3. the report returns a table with only the fields that should be accessible to the user/role.
4. remove access to the event/index for the user/role

In a way, this is using reports (or a data model) to give access to something, even though the underlying events/index is not accessible by the user/role.

[ppablo]

Hi @jhillenburg

Just following up, but did @aljohnson_splunk or @yannK's answers help solve your question? If yes, be sure to accept the appropriate answer by clicking on "Accept" below the response. If you're still having issues, it'd be great if you could comment on the answers below to to find the answers and resolve this post. Thanks!

Patrick

[yannK · Accepted solution]

"I might want our Help Desk to not be able to access the logs for a certain server"

This is easy, if you segment your data per index and use the roles to control the access.
This is also an unbreakable method.
example in the inputs specify the index, and use 2 versions of each index one public, one private, and use a wildcard in your searches.

Example : with the indexes database-public and database-secure
use a search like index=database-*

"I may want to give them access to data for a given server but not be able to view a particular field"

This is the hard part, the only solution that splunk propose is a the role search limits, by adding a mandatory search condition.

By example :
for the RoleA, always add "AND host!=securehost" to the main search conditions.

[aljohnson_splun]

Here are three useful links that will give you a good idea:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Aboutusersandroles

http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Rolesandcapabilities

http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Addandeditroles

Further more, you can create apps in Splunk to separate/create contexts for particular use cases (more advanced):

http://docs.splunk.com/Documentation/Splunk/6.2.1/AdvancedDev/DefaultApp