I have a distributed Seach (not in Cluster)
1 Search head and 1 Indexer.
Every logs are stored on the indexer and with the search head user can search ....
The problem is ... that I can allow a specific index per roles only on the indexer.
But user don't have an access to the indexer, they search via the GUI of the Search Head.
On the Search Head, I don't see the index create on the indexer, so the user have an access on every index
Is that possible to limit the access the search head ?
Thanks in advance
Yes, you would need to keep that configuration in sync.
Since you are not using clustering, in theory you could use a Deployment Server to centrally manage such configuration that needs to go to multiple systems. But setting that up just for this 1 config file might be a bit overkill.