Splunk Search

Restricting users from search

pradeepkumarg
Influencer

We have a situation where we need to restrict users to be able to search during a specific period of time. Removing search=enabled for a particular role in authorize.conf is not working. Is there a way we can achieve this for a role?

0 Karma

ayme
Splunk Employee
Splunk Employee

Associated with the User Role, you could add a "Restrict search terms" filter.

If for a very specific period in time you could add, for example:

(_time>1417805142.703 AND _time<1417805242.703)

Or if you want to prevent people searching data between 18h00 and 19h00 you could add the filter:

date_hour!=18
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You want user to able to log in but not able to perform search on specific period like 6:00 PM to 6:00 AM?

0 Karma

pradeepkumarg
Influencer

@somesoni2 Right but the timings are not fixed, it's when we know that there is going to be a users storm logging in and issuing searches to solve a very high severity issue happening in the organization, it's at that point of time we want to restrict searching only for a critical team/role to save Splunk system resources from taking a toss..

0 Karma

sdaniels
Splunk Employee
Splunk Employee

I don't believe there is a way to restrict user search access based on time. You could certainly remove the indexes that are searchable from a role to avoid users searching on specific/all data during a specific period. That would require a restart of Splunk of course.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...