RBAC Data Access in Splunk Log Observer Connect: Index Permissions

Applicability

Description

When using Splunk Log Observer Connect (LOC) to access log data from Splunk Enterprise or Splunk Cloud Platform, all data presented in the Observability Cloud is governed by the permissions of the dedicated service account configured for LOC. There are no granular "data" controls or per-user data filtering in the Observability Cloud interface for LOC data. This article outlines how RBAC is enforced, identifies who can see which data, and provides guidance on restricting access appropriately.

Investigation

To determine if this issue applies to your environment, follow these steps:

1. Verify Your Integration:
   Confirm that your Observability Cloud environment is connected to Splunk Enterprise/Cloud via Log Observer Connect.

2. Identify the Service Account Used by LOC:

   • Access your Splunk Enterprise or Splunk Cloud Platform.
   • Locate the service account configured for Log Observer Connect.

3. Review Data Visibility in Observability Cloud:

   • Log into the Observability Cloud.
   • Open Log Observer and view available data.
   • Ask multiple users with different roles to access Log Observer Connect and compare the data they see.

4. Check Service Account Permissions:

   • In Splunk Enterprise/Cloud, review the roles and index permissions assigned to the LOC service account.
   • Navigate to Settings > Roles and locate the LOC service account.
   • Check which indexes and datasets this account has access to.

5. Confirm Lack of Per-User Filtering:

   • Note that all users in Observability Cloud with access to Log Observer Connect will see exactly the same log data as defined by the service account’s permissions.
   • No additional row-level or index-level filtering is applied based on the individual user’s RBAC in Observability Cloud.

Resolution

All users with access to Log Observer Connect will see the same data, as defined by the LOC service account. No per-user RBAC filtering is enforced in Observability Cloud for Log Observer Connect data. Multiple Observability Cloud users with different roles will see the same data if the LOC service account has access to the same set of indexes.

Always ensure sensitive roles and index configurations are managed by trusted administrators.

To control which log data is accessible through Log Observer Connect, adjust the permissions assigned to the LOC service account in Splunk Enterprise or Splunk Cloud Platform. All users will only see the log data that the service account is allowed to access.

Steps to restrict data visibility:

1. Modify the Service Account’s Role:

   • Log into Splunk Enterprise/Cloud as an administrator.
   • Navigate to Settings > Roles.
   • Select the role assigned to the LOC service account.

2. Adjust Index Permissions:

   • In the role configuration, modify the list of indexes the service account can search.
   • Remove any indexes you do not want exposed through Log Observer Connect.

3. Save Changes and Validate:

   • Save your changes.
   • Log back into Observability Cloud and confirm that only the intended data is visible in Log Observer Connect for all users.

Related Links

• Splunk Lantern: Configuring Log Observer Connect