Security

Default app vs role indexes

aholzer
Motivator

I have begun an investigation into best practices for default index configuration.

So far I have found two options:

  1. Setting the attribute "defaultDatabase" in the indexes.conf at the app level. See here: http://docs.splunk.com/Documentation/Splunk/5.0.4/Admin/indexesconf. This seems to be limited to a single index.
  2. Using the default index feature of the role configurations. This way you can configure multiple indexes as the default index to search against.

Question:

How do the defaults at the App level vs the Role level interact?

When a user has multiple roles with differing default indexes, the user ends with a combination of all default indexes as their default indexes. Do these settings interact in a similarly cumulative behavior? Or does one take precedence over the other?

Tags (3)
1 Solution

aholzer
Motivator

I just tested this myself, and I believe that the defaultDatabase in the indexes.conf is not doing what the spec says it does

The test:
I created a new app (test_app) indexes.conf defined as "defaultDatabase = myindex"

I created a new role (test_role) it has all the privileges that the default "user" role has, but no default index defined

I created a new user (test_user) which has the "test_role" set to it

I logged in as "test_user" navigated to "test_app", ran a blank search for the last 60m and received events from any index that had events, rather than only events from "myindex"

------------ Update ------------

This implies that the "defaultDatabase" doesn't affect the index that the Searches query inside an app. Therefore there is no interaction between the default indexes defined in the Role and the default database defined at the app level.

View solution in original post

aholzer
Motivator

I just tested this myself, and I believe that the defaultDatabase in the indexes.conf is not doing what the spec says it does

The test:
I created a new app (test_app) indexes.conf defined as "defaultDatabase = myindex"

I created a new role (test_role) it has all the privileges that the default "user" role has, but no default index defined

I created a new user (test_user) which has the "test_role" set to it

I logged in as "test_user" navigated to "test_app", ran a blank search for the last 60m and received events from any index that had events, rather than only events from "myindex"

------------ Update ------------

This implies that the "defaultDatabase" doesn't affect the index that the Searches query inside an app. Therefore there is no interaction between the default indexes defined in the Role and the default database defined at the app level.

yannK
Splunk Employee
Splunk Employee

For default database and databases searches by default, if an user is member of several roles or inherit between multiple roles, the final result will be the sum of all the permissions.

  • roleA : defaultDatabase=indexA
  • roleB : defaultDatabase=indexB, indexC,_*
  • user with roleA and role B will have: indexA,indexB, indexC,_*

For the default app, I have no idea, it may be alphabetical based on the role or on the app name...
to verify

0 Karma

aholzer
Motivator

Yeah, I was aware of the cumulative nature of default indexes / databases between multiple roles, I was wondering if the app default is also cumulative with the role defaults.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...