Splunk Search

user role to specific index not working with index=*

sarit_s
Communicator

Hello
i have several reports that contains the search index=something__something
in my case, '
' is the name of the region

i've created a role that has access to only one index (i have index per region)
and set this role to a user

when im searching with this user on specific index, the role is working but when im running the report with index=something_*_something it is not working and im getting all the data

is it possible to set roles on indexes when searching for index=*?

Tags (1)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @sarit_s,

Good question and yes it's absolutely possible ! The report you're running could be using a different user than the one you are when testing the search on the search interface. So please verify that.

Once that's verified, make sure that user is configured to use only the indexes that he's allows to see. steps are here :
https://docs.splunk.com/Documentation/PCI/3.8.0/Install/ConfigureUsersRoles#Configure_the_roles_to_s...

Let me know if that works!

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @sarit_s,

Good question and yes it's absolutely possible ! The report you're running could be using a different user than the one you are when testing the search on the search interface. So please verify that.

Once that's verified, make sure that user is configured to use only the indexes that he's allows to see. steps are here :
https://docs.splunk.com/Documentation/PCI/3.8.0/Install/ConfigureUsersRoles#Configure_the_roles_to_s...

Let me know if that works!

Cheers,
David

0 Karma

sarit_s
Communicator

Hi @DavidHourani
this is exactly what i did and the results are as i wrote in my question

how can i verify which user is running the job except of checking which user is logged in ?

0 Karma

DavidHourani
Super Champion

The user running the search IS the user logged in. The user running the report is the owner of the report. Have a look who owns the report, if it's admin, then it will run over all indexes because of the *.

0 Karma

sarit_s
Communicator

oh.. ok
is it possible to control it ?
since all the reports was created by admin but now i have multiple users that has to run this reports

0 Karma

DavidHourani
Super Champion

yeah you can change it from savedsearch.conf and form the GUI. But if you want to run the report in a scheduled way each user must own their own report to get different results 🙂

0 Karma

sarit_s
Communicator

wow. it's crazy to manage such thing !
there is no other way ?

0 Karma

DavidHourani
Super Champion

it works perfectly well for your dashboards when you use something like thisindex=something_*_something, but yeah for saved searches and reports they will always run with the owner's account..

0 Karma

sarit_s
Communicator

thanks !

0 Karma

sarit_s
Communicator

Hey
just an update, maybe it can be helpful to other

when setting report's permissions it is possible to choose if the report will run as the report's owner or by user

i don't know if it is a new feature but it is there 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...