Gonna paint out a scenario to help explain what I'm looking for.
I have a user, he's a developer for a specific application. I have other users who are devs for other applications. They all belong to the same line of business within the company.
The business's index is readable only to people within that business unit's AD group structure.
We also have several other indexes that are readable to anyone who can authenticate into Splunk. This is all internally public data.
Right now, application data for each line of business comes into an index for the entire business. This was set up this way to simplify deployment server (serverclass.conf) configurations, and to minimize the amount of inputs.conf configurations we'd have to roll out.
However, the business is now asking for the ability to give developers access to only non-production data for only their applications.
We don't want to split into different indexes, since we'd then end up with index names of the sorts of "bu-myapp-prod", "bu-myapp-dev", etc.
A few things to make it easier.. I have a lookup table (regenerated daily) that when matched with a host, tells me the application and tier it belongs to.
I'm hoping to use this in conjunction with role search filters to get to the state I want. I'm almost there - I have a role created where the user is only able to search for data for his/her app and tier's data.
However, right now I lose access to the globally shared data.
My idea set up would look like:
- If index=business, then use data from the lookup table and filter only provided
- If the index is one of the public ones, then proceed as normal.
Essentially, I only want to filter results if they are coming from one specific index. All others should go through unfiltered.
