@bowesmana Ill test this out and report back. If I can pass the captured variables, it should work.   Search filters on roles might be a bit too limiting, though admittedly I'm not sure.  Most users with access to splunk already have roles, so unless the search filter would apply only to the indexes in the new role (IE users with Role A have access to index A and Role B have access to filtered search index B) it might not work for me.     ... View more