Is it possible restrict a user search by data values?

[hketer]

Hey!

For example, if I have events contain different countries.
Is it possible to restrict users by specific values?
So they'll be able to search only specific country or more.

I know the is option to restrict by index, its not what I want.
Thank you!!

[vishaltaneja070]

Hello @hketer

If there is field called countries, then you can restrict by search term in roles definition like County = "Australia".

[mayurr98 · Accepted solution]

I do think if you can do it by a user, but we can definitely do it by Role and then you can assign the role to that specific user.

Go to Setting>>Access controls>>Roles
you can use specific search values or field value

for example,
1) "Canada" OR "Nepal" OR "America" OR ..

2) "Country=Canada" OR "Country=Nepal" OR "Country=America" OR ..

For more info read,
https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Addandeditroleswithauthorizeconf#Search_...