Splunk® Enterprise

Search Manual

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Give your users role-based access control of federated indexes

When you define a remote deployment as a standard mode federated provider, you also create federated indexes on the federated search head of your local deployment. See Create a federated index.

On your local deployment, you must define additional role-based access control rules that identify the federated indexes to which your users have access. Each federated index on your local deployment maps to a single dataset on a standard mode federated provider, so this practice ensures that specific roles have access only to specific remote datasets.

After you create federated indexes, follow these steps.

  1. On the local deployment, in Splunk Web, select Settings, then Roles.
  2. Select the name of a role that you have associated to users who run federated searches.
  3. Select Indexes to display the contents of the Indexes tab.
  4. Locate the federated indexes you have defined. All federated index names in the Indexes list begin with federated:.
  5. Select Included for a federated index to let users with this role see search results from that index.

    If you do not select Included for any federated indexes, users with this role cannot run federated searches over standard mode federated providers.

    Do not add any federated indexes to the Default index column for a role. Users who run standard mode federated searches must always reference federated indexes by name in those searches.

  6. To save all of the changes you have made and close the dialog box, select Save.

See Create and manage roles with Splunk Web, in the Securing the Splunk Platform manual.

Last modified on 02 October, 2023
PREVIOUS
Create a federated index
  NEXT
Run federated searches

This documentation applies to the following versions of Splunk® Enterprise: 9.1.0, 9.1.1, 9.1.2


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters