I have a use-case where a Splunk end-user should only be allowed to search on a subset of events in an index. For example, restrict the end-user to only be able to search for customer's data which the end-user has authorisation to. Is there a smart way of doing this in Splunk? I looked into different solutions like Splunk Apps, External Lookup, Custom parameters in OAuth... Building a new front-end app and use the Splunk search API is one way, however, that is probably not the smartes ways of doing it.  I guess that I'm not the first one that has this use-case. ... View more