Security
Highlighted

Restrict search term not working on a new created role inheriting the admin role

New Member

Hi there,

I have created an automatic lookup to separate events for different teams so that each events would be assigned a new field "team".

Then I would like to use this field as the restrict search terms for below roles:
1. teamaadmin -> Restrict search terms "team=teama" + inherit the admin role
2. team
auser -> Restrict search terms "team=teama" + inherit the user role

And I found that the new role "teamauser " is working as I expected. Those hosts not belonging to team A are filtered out.
But the role "teamaadmin" is still showing all hosts.

Tested on Splunk version 7.1 and 6.5, same result.

Would anyone know the way to use the restrict search terms for admin role?

Many thanks.
DA

0 Karma