All Apps and Add-ons

Guidance for using Splunk Apps while restricting access to data per department

cyndiback
Path Finder

Looking for best practices/guidance

Our organization has several departments. Each department maintains their own Windows/Unix servers. Forwarders (mixture of universal/heavy) are installed on each server. We have a single Splunk instance (indexer and search head to same machine). We have a requirement that each department should only see data generated by their equipment. We would like to use the Splunk Windows and Linux apps. We have been restricting access by index but these apps use index=os by default.

What is the best approach for deploying the apps while restricting access to the data per department?

0 Karma
1 Solution

gfuente
Motivator

Hello

You need to segregate the data by index. So you would need to modify all your inputs.conf to include a departament specific index, lets say: index= osdepartment1. But you could keep the sourcetypes

And then in the *nix app or window app, remove all index references from the search strings, so it will retrieve data from all indexes that contain the specified sourcetype.

Then, you only need to give access to users to their respective index, and they will only see the data from their department

Regards

View solution in original post

gfuente
Motivator

Hello

You need to segregate the data by index. So you would need to modify all your inputs.conf to include a departament specific index, lets say: index= osdepartment1. But you could keep the sourcetypes

And then in the *nix app or window app, remove all index references from the search strings, so it will retrieve data from all indexes that contain the specified sourcetype.

Then, you only need to give access to users to their respective index, and they will only see the data from their department

Regards

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...