I have created a role that has the following permissions: [role_blah] rtsearch = enabled schedule_search = enabled search = enabled srchFilter = sourcetype=mysource (host=host1* OR host=host2*) srchIndexesAllowed = myindex srchIndexesDefault = myindex srchMaxTime = 0 This works as expected in the search app. When I use another app (splunk license usage, incidentally) A user in this role (and no other role) is able to search the _internal index as well. To clarify I can't search the _internal index using search and reporting app, I hope due to index restriction in role definition, but I can using the license usage app. Is this expected? I guess I can "fix" it by changing the permission on the app to only allow other roles, but there are many apps and many other objects to remove this permission from, and I expected the role definition to work across all apps. ... View more