All Apps and Add-ons

How can I restrict a user role to only access and search data for a certain Splunk app?

vvelpuri
Explorer

I have a user and I created a role call 'X'. I updated the role with Restrict search terms "Splunk App for AWS", but the user is unable to search the data on search head. Do we have to provide any access to the user in order to search for the data?

0 Karma

woodcock
Esteemed Legend

You cannot. The only secure way to restrict access to data is to put it in a separate index and then remove that index from the role's setting.

0 Karma

lguinn2
Legend

You can't put the name of an app in the search terms - that will not work at all! Here is what you need to do:

In the role X: make sure that the allowed indexes and default indexes are correct. This is how you control access to data. Make the "Splunk App for AWS" the default app for role X. When the user logs in, he/she will automatically be in the default app.

For each app: Go to Manage Apps. Check the permissions. For the "Splunk App for AWS," make sure that the role X has at least "read" permissions. For all other apps, make sure that role X has no permisssions. This will probably require that you change the permissions for many apps, which often default to "Read" and even "Write" for everyone.

nawazns5038
Builder

For each app: Go to Manage Apps. Check the permissions. For the "Splunk App for AWS," make sure that the role X has at least "read" permissions. For all other apps, make sure that role X has no permisssions. This will probably require that you change the permissions for many apps, which often default to "Read" and even "Write" for everyone.

Is it okay to do that in the search head cluster from the UI. Or is it something that is needed to be done from the deployer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...