the setting is in authorize.conf
use this example:
[role_ninja]
rtsearch = disabled
importRoles = user
srchFilter = something=something
srchIndexesAllowed = *
srchIndexesDefault = mail;main
srchJobsQuota = 8
rtSrchJobsQuota = 8
srchDiskQuota = 50
read here:
https://docs.splunk.com/Documentation/Splunk/7.3.2/Security/Addandeditroleswithauthorizeconf
and in more detail here:
https://docs.splunk.com/Documentation/ITSI/4.3.1/Configure/authorize.conf
hope it helps
... View more