Splunk Search

Restrict search command usage (rest in particular)

Path Finder

I am looking to restrict the use of certain search commands for particular users / roles.
In particular I would like users not to be able to use the rest command.

I have created a role and only added the capabilities change_own_password, rtsearch, and search, while also restricting search access to two (empty) indexes. However, using the this query:

| rest services/data/indexes

users will still be able to see all indexes (on the standalone server). Is there a way to prevent this?

0 Karma


You can finde a documentation about capabilities here. there are even some capabilities for the rest api e.g. dispatch_rest_to_indexers

0 Karma

Path Finder

Thank you for your answer. I found the dispatch_rest_to_indexers capability. However the current Splunk setup is a standalone server. So not assigning this capability doesn't help in this case (in fact, I didn't assign it and the mentioned rest query can still be used). I think I need to disable the rest command all together somehow. Do you know if that's possible?

0 Karma


I think you can use the restmap.conf to disable the restapi e.g. with acceptFrom

acceptFrom=<network_acl> ...
* Lists a set of networks or addresses to allow this endpoint to be accessed
* This shouldn't be confused with the setting of the same name in the
  [httpServer] stanza of server.conf which controls whether a host can
  make HTTP requests at all
* Each rule can be in the following forms:
    1. A single IPv4 or IPv6 address (examples: "", "fe80::4a3")
    2. A CIDR block of addresses (examples: "10/8", "fe80:1234/32")
    3. A DNS name, possibly with a '*' used as a wildcard (examples:
       "myhost.example.com", "*.splunk.com")
    4. A single '*' which matches anything
* Entries can also be prefixed with '!' to cause the rule to reject the
  connection.  Rules are applied in order, and the first one to match is
  used.  For example, "!10.1/16, *" will allow connections from everywhere
  except the 10.1.*.* network.
* Defaults to "*" (accept from anywhere)

Find the docu here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Restmapconf

Hope this helps!

0 Karma

Path Finder

Thanks for the reply! I have tried this, but I'm not sure what to edit exactly. Could you provide an example that would disable the particular rest command I mentioned?
Also, I'm not sure that whitelisting an ip-address would work? Wouldn't the rest command from the search bar use localhost? Haven't been able to try this, since I'm not sure what to edit in de restmap.conf file.

0 Karma

Loves-to-Learn Lots

Still have this issue?

I’ve found a solution for that. 

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...