The most robust approach is to put each different role's data into its own index. You'd have a "mail" index and a "weblogic" index, and each inputs.conf stanza would explicitly say index=<foo> . Then, you configure each role as to the index(es) it's allowed to use, and drop the users into the proper roles .... and Bob's your uncle. ... View more

Thanks for the quick response. I am able to successfully configure Splunk Search. ... View more