Thank you for your response. USE CASE: - Single index (e.g., "main") containing logs from all users - Events are distinguished by a field: user_id (or owner, username, etc.) - 4000 users authenticated via (SAML) - Each user should only see their own events (where user_id matches their username) GOAL: Apply user-specific filtering WITHOUT creating 4000 individual roles. IDEAL SOLUTION (if possible): A single role with dynamic filtering: [role_users] srchFilter = user_id="$user$" Where $user$ is automatically replaced by the authenticated username. QUESTION: Does Splunk support this pattern? Can srchFilter use the $user$ variable to dynamically filter based on the logged-in username? If not, what is the recommended approach for this scenario without creating thousands of roles? Thank you for your guidance.
... View more
