Deployment Architecture

Index rights

arkonner
Path Finder

A new index has been created by a splunk's user with admin rights - Only this user is able to use it; the other user with the same rights are unable to use it in a search - where these access rights should be granted in splunk.

Tags (2)
0 Karma

arkonner
Path Finder

This to confirm that the user is able to run a search using this index but not through a dashboard.

0 Karma

DennisMohn
Path Finder

Is the other user able to use the index by issuing the search command index=yourindexname?

You have to set the indices which are used by default via "Settings => Access controls => Roles => RoleName => Indexes searched by default"

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You can specify which indexes are searchable by default to users via user roles and rights, based on user or group. See the docs :

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutusersandroles

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...