search filter limit for user

Question

I just want esrs user see only esrs index,but it has no data if i command the srchfilter out. the user see all indexes. thanks

this is my authorize.conf

role_esrs
rtsearch = enable
srchFilter = host=host*
importRoles = user
rtSrchJobsQuota = 0
srchDiskQuota = 0
srchIndexesAllowed = index
srchIndexesDefault = index
srchJobsQuota = 0

Answer 1

0

I think your issue here is that you are also importing the user role. And that role allows users to search all non internal indexes by default. Try removing that role from the inhereted list, then tweak the esrs role. You shouldn't have to use any search restrictions to achieve this.

link

answered 20 Sep '11, 10:16

Joetron
1.9k●1●2●12
accept rate: 25%

if i remove user role, i got an error when login Internal Server Error

AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/test/search/properties/app?fillcontents=1

(20 Sep '11, 12:36) duongl2

Yeah, that's because the user role has the REST_Properties Capabilities to allow the users to access it via web. An easier approach would be to just remove the all of the indexes in selected search indexes in the user role, then just specify what indexes the other roles can search. Or you could add the REST capabilities to the esrs role.

(20 Sep '11, 14:29) Joetron

Answer 2

0	That worked for me! Thank you, Joetron link answered 07 Oct '11, 11:38 nurtdi 11●3 accept rate: 50%

search filter limit for user

Follow this question

Splunk Resources

Related questions