All Apps and Add-ons

Can we restrict user market wise or region wise

bwniranjan
New Member

Can we restrict user market wise or region wise. We have a users who can see all the data now once he login. But, we are looking at the option to restrict them market wise or region wise.

Tags (1)
0 Karma

FrankVl
Ultra Champion

The only manageable way to do that is to split your data into regional indexes and then give the users access only to the indexes of their region. But that is easier said than done if you already have a bunch of indexes with data at the moment 🙂

0 Karma

bwniranjan
New Member

If I create new indexs, what we do with existing data in indexes? That data still be visible for them.

0 Karma

FrankVl
Ultra Champion

I guess you have a couple of options:
- delete the old data (rather drastic)
- restrict access to that data to a few privileged individuals just in case the old data is still needed
- leave it as is with everyone having access, until that old data ages out (perhaps add some monitoring on people querying those old indexes)
- export raw events and re-index it into the new indexes and then delete the old data (lot of work)

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...