Splunk Search

Why is Restrict Search Terms not working

dflodstrom
Builder

I want to restrict a given role's access to the data in Splunk by using 'Restrict search terms' under access controls. First I tried to restrict based on tag...ie. tag=mytag. This didn't work, so I tried to restrict on one host value...ie. host=hostname. This isn't working either.

I am attempting this on a standalone search head in a distributed environment with an indexer cluster. I will apply this to my search head cluster when it is functional. It might also be useful to know that the role I'm modifying does have another role that is inherited which has its own restrict search terms configured. We're using Splunk 6.3.0.

1 Solution

dflodstrom
Builder

There must have been a conflict with using 'restrict search terms' on the role I was modifying and the inherited role. I was able to resolve this issue by removing the inherited role. Of course after doing this I needed to apply all of the settings from the inherited role to the role I was modifying.

View solution in original post

MLGSPLUNK
Path Finder

Hi!

I am running on the same issue as you did but on splunk 8.0.5. No roles are inherited and only search is granted to the user, but the search terms for the restrict search are not working at all and the user can see all the data.

 

https://community.splunk.com/t5/Splunk-Search/Restrict-search-to-a-role-using-a-search-restriction-i...

 

Thanks in advance.

0 Karma

Kyle_Sandoval
Explorer

Dflodstrom is correct; the issue is the inherited role, but you don't have to remove the inherited role to resolve. You just need to set a value (any value) in the restrict search term parameter value. If it's blank, Splunk takes the inherited value from the role. Simply setting the value to '*' will override the inherited values.

0 Karma

Kyle_Sandoval
Explorer

Dflodstrom is correct; there is a conflict with the inherited role, but you don't have to remove the inherited role to resolve the conflict. Rather than clear the restrict search term value, you have to replace it with a value. If you want no restrictions, replace the value with a "*" which will override the parameter's value from the inherited role.

0 Karma

dflodstrom
Builder

There must have been a conflict with using 'restrict search terms' on the role I was modifying and the inherited role. I was able to resolve this issue by removing the inherited role. Of course after doing this I needed to apply all of the settings from the inherited role to the role I was modifying.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...