Turning on Splunk platform role-based field filtering
By default, role-based field filtering is turned off. Before you can use role-based field filters to protect sensitive data in your organization, you must turn on role-based field filtering.
Splunk Cloud Platform
- To turn on role-based field filtering in your environment, request help from Splunk Support. If you have a support contract, file a new case using the Splunk Support Portal at Support and Services. Otherwise, contact Splunk Customer Support.
- To turn on role-based field filtering in your environment, follow these steps.
- Only users with file system access, such as system administrators, can edit configuration files.
- Review the steps in How to edit a configuration file in the Splunk Enterprise Admin Manual.
Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location. Make changes to the files in the local directory.
- Open or create a local limits.conf file at $SPLUNK_HOME/etc/system/local.
- In the
[search]stanza, add the line
- Restart the Splunk platform, so the change to the limits.conf file takes effect.
- To use field filtering in clustered environments, the limits.conf file that is pushed to all search heads and indexers must include
Planning for role-based field filtering in your organization
Setting role-based field filters with the Splunk platform
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209 (latest FedRAMP release)