Suppose i have 6 aws instances sending log to splunk and we have 3 user :
1st is admin can see all 6 instances
2nd is user1 can see only 2 specific instances
3nd is user2 can see only 2 specific instances
user 2 and 3 can only see which they are configured to.