Splunk Search
Highlighted

Index Access

Path Finder

Hi,

I want to give access to my splunk customers users acccess to only specific imndexes and not main indexes.

I also want to restrict that they search on that specific index and not main index, so if i created an index called sitest - the user by default should search in sitest and have access to this index data only - is that possible?

0 Karma
Highlighted

Re: Index Access

Legend

Absolutely!

This is set in the roles, under Access Controls. I recommend that you set up a new role and give it access to only the indexes that you want. Then assign the users to that role.

Do not use role inheritance unless you read the documentation and/or understand how access to indexes is inherited.

View solution in original post

0 Karma
Highlighted

Re: Index Access

Path Finder

I actually tired that, my AD has a group called XYZ, it has 2 users.

I created a AD auth through splunk, user shows up and i assigned role to these users.

Role only give them priv to log in and search on index si_test and block index "main"

still when i log in as that user, i can search on events which are supposed to be main index, no idea why ?

I am at 6.0.3

0 Karma