I created a user role that restricts search capabilities to certain sources, but there are fields I would like to hide from the user and exclude the _raw data. Is there a way to do this? Edit: I've expanded this question and I may have found a partial solution, but I'm unable to restrict a user from searching data that I don't want them to. Example event: source=my_source user_id=123456 user_secret=99999999 login_status=successful I restricted the search terms of the user role to source="my_source" user_id=123* . In addition, I created calculated fields for user_secret and _raw and set the eval expression to null() . This restricts the user to see only events in my_source where the user_id starts with 123 and hides the fields user_secret and _raw , but it doesn't prevent the user from being able search data that they are not privy to. For example, this search source=my_source 99999999 | table user_id login_status user_secret _raw will return user_id login_status user_secret _raw 123456 successful (null) (null) Even though I've restricted the search and hide fields, a user would still be able to deduce that the secret for user 123456 is 99999999. Am I missing something? Is there a way to limit which data/fields a user can search? Another possible solution is to create a separate index but that doesn't seem very efficient to me since data would be duplicated. This is somewhat related to a separate question I asked Can users be restricted to only search data models?. I think this may be a viable solution as well. ... View more

I'd like to give certain user roles the ability to search data models. However, I don't want them to be able to view the data in search. Is this possible? ... View more

Is it possible to lock a Splunk user account if there are multiple failed login attempts? I've created an alert for such events, but was wondering if there was a way to lock an account as well. ... View more

In an environment that provides reporting across many different time zones, should summary searches run under a user set to the default system time, GMT time, or doesn't it matter since Splunk will adjust the time based on the user's time zone? ... View more