Hi everyone, I am in the need to find a way to filter data that specific roles access inside an index. For example: Index=servers The index has servers from windows, linux, and ostype3 We want to have the following: roleA has access to index=servers (but just sees windows servers) roleB has access to index=servers (but just see linux servers) roleC has access to index=servers (but just see ostype3 servers) This can be achieved by using search filters and it worked ok. However... If then, I have a role that can: RoleD has access to index=servers (but just see windows servers)  RoleD has access to index=firewalls This then will not work for roleD. RoleD will not be able to search for the index=firewalls, as the search filters takes precedence and limits the user just to see the data in: RoleD has access to index=servers (but just see windows servers)    So, I'm trying to find a new solution that can allow me to do what I need to, and summary index came to the idea. However I'm struggling with something. When my data is sent to the summary index, it's sourcetype is changed to stash. And then my data is not parsed as is in the original index. Lets suppose I change the sourcetype from stash to original sourcetype, that then will make me use a lot more license and double it up. So, that's why I'm asking here for help. What solutions do I have? Am I missing something or doing something wrong? Thanks in advance if someone can help me on this. 🙂   ... View more