Restrict index access using Eventtype

[santiagn]

We have over 1000 users, we are using Active Directory, Mapping groups to Roles, and we have 100's of indexes. We need to restrict access to indexes due to sensitive data. Our plan is to use "roles" and restrict the role by Event types. Those Event Types will map to certain indexes using wildcards. The question is: a) is there a better way and b) will this negatively impact performance.

[kmorris_splunk]

You could do that with the "Restrict Search terms" field within a role:

[santiagn]

will this affect performance at all? slower searches etc?

[ddrillic]

Our plan is to use "roles" and restrict the role by Event types.
How do you do that?

Eventtypes were designed for categorization - so it might be a good choice ; -)