New Link https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges ... View more

I'm also curious on how this would work in a slightly different scenario - Search Peering. Where Indexers/CM is in one VPC and SHC/Deployer is in a different VPC.  I would also assume you would need a 1-to-1 number of NLB in the Splunk Indexer VPC, and a 1-to-1 PrivateLink in the Splunk SHC VPC for each indexer in the you'd want to connect to.  ... View more

Dflodstrom is correct; the issue is the inherited role, but you don't have to remove the inherited role to resolve. You just need to set a value (any value) in the restrict search term parameter value. If it's blank, Splunk takes the inherited value from the role. Simply setting the value to '*' will override the inherited values. ... View more

Dflodstrom is correct; there is a conflict with the inherited role, but you don't have to remove the inherited role to resolve the conflict. Rather than clear the restrict search term value, you have to replace it with a value. If you want no restrictions, replace the value with a "*" which will override the parameter's value from the inherited role. ... View more