Splunk Search

Index Access

nikhilmehra79
Path Finder

Hi,

I want to give access to my splunk customers users acccess to only specific imndexes and not main indexes.

I also want to restrict that they search on that specific index and not main index, so if i created an index called si_test - the user by default should search in si_test and have access to this index data only - is that possible?

0 Karma
1 Solution

lguinn2
Legend

Absolutely!

This is set in the roles, under Access Controls. I recommend that you set up a new role and give it access to only the indexes that you want. Then assign the users to that role.

Do not use role inheritance unless you read the documentation and/or understand how access to indexes is inherited.

View solution in original post

0 Karma

lguinn2
Legend

Absolutely!

This is set in the roles, under Access Controls. I recommend that you set up a new role and give it access to only the indexes that you want. Then assign the users to that role.

Do not use role inheritance unless you read the documentation and/or understand how access to indexes is inherited.

0 Karma

nikhilmehra79
Path Finder

I actually tired that, my AD has a group called XYZ, it has 2 users.

I created a AD auth through splunk, user shows up and i assigned role to these users.

Role only give them priv to log in and search on index si_test and block index "main"

still when i log in as that user, i can search on events which are supposed to be main index, no idea why ?

I am at 6.0.3

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...