Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

srchFilter Role Inheritance: If a user is a member of two roles, how to have the srchFilter apply to indexes of one role, but not the other?

$
0
0
For example, I have a user (test_user) that is a member of these two roles: [role_role_a] importRoles = user srchIndexesAllowed = _audit;_internal srchIndexesDefault = _audit;_internal srchMaxTime = 0 [role_role_b] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 importRoles = user srchDiskQuota = 130 srchFilter = (ConfigVersionId=86 (Address=*)) srchIndexesDefault = iselogs srchMaxTime = 0 This works well, and when this user runs the search, the srchFilter from role_b appears to work: litsearch ( index=* ) ( ( ( ConfigVersionId=86 ( Address=* ) ) ) ) However, what I would like is only to have the srchFilter be applied to the indexes of role_b, but not role_a (ie. the filtering should not be applying to both _audit and _internal indexes). I have tried setting srchFilter = * in role_a: [role_role_a] importRoles = user srchFilter = * srchIndexesAllowed = _audit;_internal srchIndexesDefault = _audit;_internal srchMaxTime = 0 But that seems to override the srchFilter for role_b.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>