Splunk Search

Restrict access to views based on roles/users

manjunathmeti
Champion

I have 100 views and 5 different users/roles. Each user can access 20 views and this is based on prefix of those 20 views.
Example:
Type1_view1
Type1_view2
..
..
Type1_view20
Type2_view1
Type2_view2
..
..
Type2_view20
Type3_view1
..
Type5_view20

I edited local.meta as below but it is not working, each user is accessing all the 100 views. I need user 1 to access only Type1_* views, user2 to access only Type2_* views and so on.
[views/Type1_*]
access = read : [ user1 ], write : [ user1]

[views/Type2_*]
access = read : [ user2 ], write : [ user2]

Please suggest any solution you have, thanks.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi manjunathmeti,
I don't think that you can use asterisk in local.meta, but you have a stanza for each Splunk Knowledge Object (views, fields, ...)

Before manually modify local.meta, try to modify, using web gui, one view for each user.
Then verify in local.meta if it's the same you manually did, and replicate for all objects.

Bye.
Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...