topic Re: Search Filters (srchFilter) when a user is in multiple groups/roles in Getting Data In

Search Filters (srchFilter) when a user is in multiple groups/roles

gkanapathy — Tue, 17 Aug 2010 04:43:50 GMT

When a user is in multiple Splunk roles (possibly because they are assigned to multiple LDAP/AD groups that are mapped to Splunk roles), what search filter is applied to that user's searches? Is one just selected, and if so which one? Or are all the filters OR'ed together?

Is there some way to select or specify one, or define a precedence? Or some way to define an overriding filter for a particular user or set of users?

Re: Search Filters (srchFilter) when a user is in multiple groups/roles

Stephen_Sorkin — Tue, 17 Aug 2010 04:58:31 GMT

All filters are ORed together to form the composite search filter. There is no precedence or override. The user is able to search any data that any of his or her roles can.

Re: Search Filters (srchFilter) when a user is in multiple groups/roles

twinspop — Sun, 15 Jan 2017 01:11:23 GMT

And what about when you're setting values to capability parameters? Which one wins? Example, srchMaxTime. 2 roles. One at 300 and one at 600. Which wins?

Re: Search Filters (srchFilter) when a user is in multiple groups/roles

jadamsplunk — Thu, 14 Jun 2018 19:40:32 GMT

1.5 years later, but... the most permissive