Splunk Search

Why is Restrict Search Terms not working

dflodstrom
Builder

I want to restrict a given role's access to the data in Splunk by using 'Restrict search terms' under access controls. First I tried to restrict based on tag...ie. tag=mytag. This didn't work, so I tried to restrict on one host value...ie. host=hostname. This isn't working either.

I am attempting this on a standalone search head in a distributed environment with an indexer cluster. I will apply this to my search head cluster when it is functional. It might also be useful to know that the role I'm modifying does have another role that is inherited which has its own restrict search terms configured. We're using Splunk 6.3.0.

1 Solution

dflodstrom
Builder

There must have been a conflict with using 'restrict search terms' on the role I was modifying and the inherited role. I was able to resolve this issue by removing the inherited role. Of course after doing this I needed to apply all of the settings from the inherited role to the role I was modifying.

View solution in original post

MLGSPLUNK
Path Finder

Hi!

I am running on the same issue as you did but on splunk 8.0.5. No roles are inherited and only search is granted to the user, but the search terms for the restrict search are not working at all and the user can see all the data.

 

https://community.splunk.com/t5/Splunk-Search/Restrict-search-to-a-role-using-a-search-restriction-i...

 

Thanks in advance.

0 Karma

Kyle_Sandoval
Explorer

Dflodstrom is correct; the issue is the inherited role, but you don't have to remove the inherited role to resolve. You just need to set a value (any value) in the restrict search term parameter value. If it's blank, Splunk takes the inherited value from the role. Simply setting the value to '*' will override the inherited values.

0 Karma

Kyle_Sandoval
Explorer

Dflodstrom is correct; there is a conflict with the inherited role, but you don't have to remove the inherited role to resolve the conflict. Rather than clear the restrict search term value, you have to replace it with a value. If you want no restrictions, replace the value with a "*" which will override the parameter's value from the inherited role.

0 Karma

dflodstrom
Builder

There must have been a conflict with using 'restrict search terms' on the role I was modifying and the inherited role. I was able to resolve this issue by removing the inherited role. Of course after doing this I needed to apply all of the settings from the inherited role to the role I was modifying.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...