Splunk Search

Isolate a Search head - search head user account

aab1
Explorer

Hi 
I found this 2011 chat "72798" on Splunk to "considering adding the concept of an "search head user account" on the indexer to allow the indexer administrator to restrict what the search head can do"

Do anybody know if this is somehow available or doable in 2024?
My case is that I need a Standalone Searchhead with access to a subset of all indexes in the Cluster.
But at the same time full control of the Searchhead (Splunk Admin capabilities except changes to the searchable index list) 
The aim is to separate the SH to be managed by a 3 party.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @aab1 ,

as I said, there's only one solution: create a custom admin without that feature and without the feature of altering roles, no other solution.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aab1 ,

you have to create a custom role, cloning the admin role (don't use inheritance), removing the feature you want and also the features to change user capabilities (otherwise the customization isn't useful!).

Then, you give to this role the grants to see only a part of indexes.

Ciao.

Giuseppe

0 Karma

aab1
Explorer

Morning Giuseppe 

Thanks for a quick reply.
My problem with this solution is that I somehow need to ensure that

1 The Full Splunk admin can't login the SH (since the SH is managed by 3 party including custom TA's)
2 The 3 party managed SH must not be able to alter the roles (so no access to the Full Admin)

Hence the need for a isolated setup where the roles are set on the Peer site.  

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aab1 ,

as I said, there's only one solution: create a custom admin without that feature and without the feature of altering roles, no other solution.

Ciao.

Giuseppe

0 Karma

aab1
Explorer

Hi again

Thank you very much clarification 🙂

/Best Rgds

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aab1 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...