I have a requirement to filter out events based on: the USER running the search and FIELD VALUES contained in the event I don't want certain users to see certain events based on a field value. For example, if I have this set of events: PartID Company Cost Count Category ------- ----------- ------- ------- -------- P1 X Corp 111.11 10 ABC P2 ABC Biz 222.22 20 ABC P3 Parts Inc 333.33 30 DEF P4 Stuff LLC 444.44 40 GHI And user "maxfoo" logs into the Splunk server, he should only be allowed to see 3 events with (Category=ABC | Category=DEF). He should NOT able to see the Category=GHI event. Are there any efficient ways to implement something like this? Thanks! ... View more