Splunk® Enterprise

Securing Splunk Enterprise

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Turning off Splunk platform role-based field filtering

At some point you might want to turn off all of your organization's role-based field filters at one time. When you turn off role-based field filtering, any existing role-based field filters you've set remain in place, but Splunk software ignores configuration information, such as field filters on roles, as well as limits on target hosts, sources, and source types. In addition, when your turn off role-based field filtering, Personal Identifiable Information (PII) and Protected Health Information (PHI) data might be visible in searches.

You can turn role-based field filtering back on whenever you want to use field filtering across your organization again.

Because turning off role-based field filters can expose sensitive data to unauthorized users, make sure that it is safe to turn field filtering off. To further secure your system, only allow certain authorized users to turn off role-based field filtering.

Splunk Cloud Platform

To turn off role-based field filtering in your environment, request help from Splunk Support. If you have a support contract, file a new case using the Splunk Support Portal at Support and Services. Otherwise, contact Splunk Customer Support.

Splunk Enterprise

To turn off role-based field filtering in your environment, follow these steps.
Prerequisites
  • Only users with file system access, such as system administrators, can edit configuration files.
  • Review the steps in How to edit a configuration file in the Splunk Enterprise Admin Manual.

Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location. Make changes to the files in the local directory.

Steps
  1. Open or create a local limits.conf file at $SPLUNK_HOME/etc/system/local.
  2. In the [search] stanza, add the line role_based_field_filtering=false.
  3. To turn role-based field filtering back on, change role_based_field_filtering to true.

See also

Protecting PII and PHI data with role-based field filtering
Turning on Splunk platform role-based field filtering
Last modified on 26 July, 2022
PREVIOUS
Limiting role-based field filters to specific hosts, sources, indexes, and source types
  NEXT
Create and manage roles in Splunk Enterprise using the authorize.conf configuration file

This documentation applies to the following versions of Splunk® Enterprise: 9.0.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters