Getting Data In

Search Filters (srchFilter) when a user is in multiple groups/roles

Splunk Employee
Splunk Employee

When a user is in multiple Splunk roles (possibly because they are assigned to multiple LDAP/AD groups that are mapped to Splunk roles), what search filter is applied to that user's searches? Is one just selected, and if so which one? Or are all the filters OR'ed together?

Is there some way to select or specify one, or define a precedence? Or some way to define an overriding filter for a particular user or set of users?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

All filters are ORed together to form the composite search filter. There is no precedence or override. The user is able to search any data that any of his or her roles can.

View solution in original post

Splunk Employee
Splunk Employee

All filters are ORed together to form the composite search filter. There is no precedence or override. The user is able to search any data that any of his or her roles can.

View solution in original post

Influencer

And what about when you're setting values to capability parameters? Which one wins? Example, srchMaxTime. 2 roles. One at 300 and one at 600. Which wins?

0 Karma

Path Finder

1.5 years later, but... the most permissive

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!