Splunk Enterprise

Appending to srchIndexesDefault / srchIndexesAllowed

southeringtonp
Motivator

For a given role, is there a way to add extend the list of allowed/default indexes, without specifying the entire list?

I know that this can be overriden in an app, but specifying the entire list at the app level seems like asking for trouble - sooner or later two apps will conflict.

For example, given the default configuration:

[role_admin]
srchIndexesAllowed = *;_*
srchIndexesDefault = main;os

Is there a macro or variable substitution that would allow tacking on, similar to how one would append new directories to $PATH or %PATH% in the operating system? I'd like to be able to do something like:

[role_admin]
srchIndexesAllowed = $srchIndexesAllowed$;newindex
srchIndexesDefault = $srchIndexesDefault$;newindex
0 Karma
1 Solution

Simeon
Splunk Employee
Splunk Employee

Roles can inherit other roles, so in this case it would make sense to have a role that inherits the base set of indexes. For example, you could have a role_base and a role_extra_stuff:

[role_base]
srchIndexesAllowed = main
srchIndexesDefault = main

[role_extra_stuff]
importRoles=role_base
srchIndexesAllowed = new_index
srchIndexesDefault = new_index

The final index capabilities would be role_base having the base set of indexes, and role_extra_stuff having both the base and specific indexes.

View solution in original post

Simeon
Splunk Employee
Splunk Employee

Roles can inherit other roles, so in this case it would make sense to have a role that inherits the base set of indexes. For example, you could have a role_base and a role_extra_stuff:

[role_base]
srchIndexesAllowed = main
srchIndexesDefault = main

[role_extra_stuff]
importRoles=role_base
srchIndexesAllowed = new_index
srchIndexesDefault = new_index

The final index capabilities would be role_base having the base set of indexes, and role_extra_stuff having both the base and specific indexes.

yoho
Contributor

Note that "importRoles=role_base" will not work, it should be "importRoles=base" instead...

southeringtonp
Motivator

Does that mean that it is not possible to have a role inherit from [role_extra_stuff] and not have it be able to access new_index?

For example, what if there are settings in [role_extra_stuff] that would be also in [role_one_more]? Those settings would have to be copied into [role_one_more] directly rather than having a third level that inherits from [role_extra_stuff]. Is that right?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...