Hey!
For example, if I have events contain different countries.
Is it possible to restrict users by specific values?
So they'll be able to search only specific country or more.
I know the is option to restrict by index, its not what I want.
Thank you!!
I do think if you can do it by a user, but we can definitely do it by Role and then you can assign the role to that specific user.
Go to Setting>>Access controls>>Roles
you can use specific search values or field value
for example,
1) "Canada" OR "Nepal" OR "America" OR ..
2) "Country=Canada" OR "Country=Nepal" OR "Country=America" OR ..
For more info read,
https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Addandeditroleswithauthorizeconf#Search_...
Hello @hketer
If there is field called countries, then you can restrict by search term in roles definition like County = "Australia".
I do think if you can do it by a user, but we can definitely do it by Role and then you can assign the role to that specific user.
Go to Setting>>Access controls>>Roles
you can use specific search values or field value
for example,
1) "Canada" OR "Nepal" OR "America" OR ..
2) "Country=Canada" OR "Country=Nepal" OR "Country=America" OR ..
For more info read,
https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Addandeditroleswithauthorizeconf#Search_...