We have a similar use case, and are running into the same problem, on 6.4.0. I have a user with a role that grants the below capabilities, but has no allowed indexes for search (only for testing, in real life, it would be able to search a subset of the available indexes): change_own_password edit_tcp output_file schedule_rtsearch search This role inherits from no other roles, and the user has no other roles. When authenticated as this user, I get no search results, and cannot use the collect command to write into any index, as is expected (or, when I have indexes allowed for the associated role, I can only use collect to write into the indexes that I am permitted to search). However, using the Splunk Python SDK (via clientInstance.index[<index_name>].submit() ) or the REST API (via /services/receivers/{simple,streaming} ), while authenticated as this user, I am able to write into any index, regardless of which indexes I am permitted to search. ... View more