Restricted search question

[klim]

I am trying to set up a restricted search for a role so that they can only see data when a field1=customer01. The default way was to do it by field1::customer01 but that didn't show any results when I previewed the results. Instead I did field1=customer01 and that worked. Is there a reason why field1::customer01 doesn't generate any results?

[venkatasri]

Hi @klim 

Splunk advises to use indexed fields for searchFilter, in your case field1 is a non indexed field so if you wish  to avoid security issue you shall covert field1 to a indexed field and use :: which is a best practice.

Using = Operator  a smart splunk user using 'user knowledge Objects' (means they are scoped to user itself not shared across) can take  advantage and bypass filter to query the data that they are not supposed to access. 

-------------------------------------------------------------------

An upvote would be appreciated if it helps!

[venkatasri]

Hi @klim 

Your 'field1'  could be a search-time field. :: works for indexed fields.

---------------------------------------------------

An upvote would be appreciated if it helps!

[klim]

@venkatasri thanks that helps. Is it okay to use field1=cust01 ? I have tested it and it works but splunk just said there may be a security concern mentioned below in the docs at the bottom of the page.

https://docs.splunk.com/Documentation/Splunk/8.0.3/Security/Addandeditroles?ref=hk