Splunk Search

How to restrict search access to certain hosts or fields on a per-user basis?

jhillenburg
Path Finder

Hello. I'm new to Splunk. This may become obvious with my next question: I would like to restrict access to certain hosts or fields on a per-user basis. IE. I might want our Help Desk to not be able to access the logs for a certain server, or I may want to give them access to data for a given server but not be able to view a particular field. What methods have people used for this? Thanks.

1 Solution

yannK
Splunk Employee
Splunk Employee

"I might want our Help Desk to not be able to access the logs for a certain server"

This is easy, if you segment your data per index and use the roles to control the access.
This is also an unbreakable method.
example in the inputs specify the index, and use 2 versions of each index one public, one private, and use a wildcard in your searches.

Example : with the indexes database-public and database-secure
use a search like index=database-*

"I may want to give them access to data for a given server but not be able to view a particular field"

This is the hard part, the only solution that splunk propose is a the role search limits, by adding a mandatory search condition.

By example :
for the RoleA, always add "AND host!=securehost" to the main search conditions.

View solution in original post

tedwroks
Explorer

Is it possible:

  1. use a report and give access to the role/user you want to restrict access.
  2. have this report run using the owner (who has access to the event/fields).
  3. the report returns a table with only the fields that should be accessible to the user/role.
  4. remove access to the event/index for the user/role

In a way, this is using reports (or a data model) to give access to something, even though the underlying events/index is not accessible by the user/role.

0 Karma

ppablo
Retired

Hi @jhillenburg

Just following up, but did @aljohnson_splunk or @yannK's answers help solve your question? If yes, be sure to accept the appropriate answer by clicking on "Accept" below the response. If you're still having issues, it'd be great if you could comment on the answers below to to find the answers and resolve this post. Thanks!

Patrick

0 Karma

yannK
Splunk Employee
Splunk Employee

"I might want our Help Desk to not be able to access the logs for a certain server"

This is easy, if you segment your data per index and use the roles to control the access.
This is also an unbreakable method.
example in the inputs specify the index, and use 2 versions of each index one public, one private, and use a wildcard in your searches.

Example : with the indexes database-public and database-secure
use a search like index=database-*

"I may want to give them access to data for a given server but not be able to view a particular field"

This is the hard part, the only solution that splunk propose is a the role search limits, by adding a mandatory search condition.

By example :
for the RoleA, always add "AND host!=securehost" to the main search conditions.

aljohnson_splun
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...