Splunk Search

Permissions for index access

jcbrendsel
Path Finder

We are running the new splunk universal forwarder on an application server. It has the standard setup to recursively index the /var/log directory.

In there we have an application subdirectory:

/var/log/tvschedules/import.log

I can search the contents of this log using any user with admin privileges, but unfortunately user with poweruser and user roles get empty search results.

Any ideas on what could be causing the issue?

Tags (3)
0 Karma

joshd
Builder

Go into the manager, then into access controls, click on roles, select the relevant role and make sure the relevant index is applied to their role. If the index this file is going into is on the left hand side under "Indexes" (and not in the grey box on the right hand side) then you need to click on the green arrow beside the index name so it gives the role permission to search on that index. Also you may wish to make it a part of the "Indexes searched by default" so that when they run their search they do not need to explicitly specify the index=whatever

cheers

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...