Create 2 new roles. ADMIN & USER. Map users to roles accordingly. 1.Goto App->Manage apps->Select the app->View objects 2.Grant READ access to admin role for all the views 3.Same way, Select particular views and grant READ access to User role. When admin login to the application , all the views are visible When User login , he could able view selected views. --RESOLVED ... View more

There is another answer on this: http://splunk-base.splunk.com/answers/517/how-to-search-recent-alerts-fired-by-splunk index=_audit action=alert_fired | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity ... View more