Security

Access to _internal index to user without providing him admin privileges

hemendralodhi
Contributor

Hello,

We have a requirement here where we need to provide access to user to _internal user so that he can run some query on that. We would like to give access to _internal index to user without admin privilege if possible.

Query: index=_internal tcpin_connections [search index=”Your Index name”| dedup host | fields host | rename host as sourceHost ] | stats values(sourceIp) by sourceHost

This query will extract the host name in your index, and search it against splunk metric index to output the Ip Address

Let me know how we can achieve this.

0 Karma
1 Solution

musskopf
Builder

I don't think the access to the "_internal" index requires Admin. You can define which index each Role can access. Have a look on the "Settings -> Access Control - > Roles" options.

View solution in original post

0 Karma

musskopf
Builder

I don't think the access to the "_internal" index requires Admin. You can define which index each Role can access. Have a look on the "Settings -> Access Control - > Roles" options.

0 Karma

hemendralodhi
Contributor

Thanks,

I found out the role user belongs to and added _internal index in that.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...