Search Filters (srchFilter) when a user is in multiple groups/roles

[gkanapathy]

When a user is in multiple Splunk roles (possibly because they are assigned to multiple LDAP/AD groups that are mapped to Splunk roles), what search filter is applied to that user's searches? Is one just selected, and if so which one? Or are all the filters OR'ed together?

Is there some way to select or specify one, or define a precedence? Or some way to define an overriding filter for a particular user or set of users?

[Stephen_Sorkin · Accepted solution]

All filters are ORed together to form the composite search filter. There is no precedence or override. The user is able to search any data that any of his or her roles can.

[twinspop]

And what about when you're setting values to capability parameters? Which one wins? Example, srchMaxTime. 2 roles. One at 300 and one at 600. Which wins?

[jadamsplunk]

1.5 years later, but... the most permissive