Splunk Search

Restrict access to views based on roles/users

manjunathmeti
Champion

I have 100 views and 5 different users/roles. Each user can access 20 views and this is based on prefix of those 20 views.
Example:
Type1_view1
Type1_view2
..
..
Type1_view20
Type2_view1
Type2_view2
..
..
Type2_view20
Type3_view1
..
Type5_view20

I edited local.meta as below but it is not working, each user is accessing all the 100 views. I need user 1 to access only Type1_* views, user2 to access only Type2_* views and so on.
[views/Type1_*]
access = read : [ user1 ], write : [ user1]

[views/Type2_*]
access = read : [ user2 ], write : [ user2]

Please suggest any solution you have, thanks.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi manjunathmeti,
I don't think that you can use asterisk in local.meta, but you have a stanza for each Splunk Knowledge Object (views, fields, ...)

Before manually modify local.meta, try to modify, using web gui, one view for each user.
Then verify in local.meta if it's the same you manually did, and replicate for all objects.

Bye.
Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...