You can do this by changing messages.conf roles attribute.
https://docs.splunk.com/Documentation/Splunk/7.2.0/Admin/Customizeuserexperience
You can do this by changing messages.conf roles attribute.
https://docs.splunk.com/Documentation/Splunk/7.2.0/Admin/Customizeuserexperience