uberAgent

Multi-Tenancy With Splunk

July 9, 2024

Contributed by:

If you are a service provider, it is not necessary to set up a dedicated Splunk server for every customer. Splunk fully supports multi-tenancy and uberAgent does, too. This article describes how to configure it.

Concepts

Splunk stores data in indexes. Regarding multi-tenancy, the important thing is that you can set permissions per index.

Setting up a multi-tenant Splunk & uberAgent installation is simple. We are going to follow the concept outlined in the Splunk blog.

Implementation

Actually, all you have to do is described very well in the Splunk blog article mentioned earlier. Here is a summary:

Create a unique index per customer. Please note that all uberAgent indexes should start with a common prefix (e.g. uberagent) so that they can be searched with a single wildcard statement (e.g. uberagent*). Valid names would be uberagent-customer1 and uberagent-customer2.
To set up custom index names follow the instructions in this article.
Configure users according to the Splunk blogs article.

Result

If you have configured this, you have a setup where Splunk administrators can search everything while individual customer admins can only search their own data.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Multi-Tenancy With Splunk

July 9, 2024

Contributed by:

July 9, 2024

Contributed by:

Multi-Tenancy With Splunk

Concepts

Implementation

Result

In this article