Index restriction not working with search head and search peers

[takn4granted]

We have 1 search head with 2 search peers. We have numerous indexes defined on the search peers, for example index A, B on the first peer and index C, D on the second peer. Using the search head we are able to search all the indexes as expected. We want to have our users perform all searches from the search head, however, when we define roles on our search head we are we are unable to see the remote indexes (index A,B,C,D) and thereby unable to restrict those indexes from any roles. Only the local indexes are showing within the Roles configuration screen.

what is the proper way to restrict users from searching those remote indexes?

[chimbudp]

Hi bro,

While creating new roles , please carefully add indexes to be searched/restricted for that particular role,
Later assign that role to any user and you test.

Goto ,

Manager » Access controls » Roles »

Indexes searched by default:(Set the index(es) that searches default to when no index is specified. User with this role can search other indexes using index= (e.g., "index=special_index").)

Indexes :(Restrict this role's searches to the specified index(es). Search results for this role will only show events from these indexes.)

[dwaddle · Accepted solution]

Define the indexes on the search head - even if they are entirely empty, this is okay. That will make them appear in the manager UI on the search head so you can establish roles as needed.