Security

Restrict search term not working on a new created role inheriting the admin role

dashalfy
New Member

Hi there,

I have created an automatic lookup to separate events for different teams so that each events would be assigned a new field "team".

Then I would like to use this field as the restrict search terms for below roles:
1. team_a_admin -> Restrict search terms "team=team_a" + inherit the admin role
2. team_a_user -> Restrict search terms "team=team_a" + inherit the user role

And I found that the new role "team_a_user " is working as I expected. Those hosts not belonging to team A are filtered out.
But the role "team_a_admin" is still showing all hosts.

Tested on Splunk version 7.1 and 6.5, same result.

Would anyone know the way to use the restrict search terms for admin role?

Many thanks.
DA

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...