A Splunk Cloud administrator is looking to allow a new group of Splunk users in the marketing department to access the Splunk environment and view a dashboard with relevant data. These users need to access marketing data (stored in the marketing_data index), but shouldn't be able to access other data, such as events related to security or operations.
Which approach would be the best way to accomplish these requirements?

Question

A Splunk Cloud administrator is looking to allow a new group of Splunk users in the marketing department to access the Splunk environment and view a dashboard with relevant data. These users need to access marketing data (stored in the marketing_data index), but shouldn't be able to access other data, such as events related to security or operations.

Which approach would be the best way to accomplish these requirements?

Rajesh Maharajan · Accepted Answer

Create a new role that inherits the user role and remove the capability to search indexes other than marketing_data.

Rajesh Maharajan · Answer

Create a new user with access to the marketing_data index assigned.

Rajesh Maharajan · Answer

Create a new role that inherits the admin rote and assign access to the marketing_dat.a index.

Rajesh Maharajan · Answer

Create a new role that does not inherit from any other role, turn on the same capabilities as the user role, and assign access to the marketing_data index.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 6 - SPLK-1005 discussion

Suggested answer: B

0 comments