Can we have configure users according to the monitors defined at the Universal Forwarder?
We are trying to have a splunk server which monitors mail server and weblogic logs. I am trying to create users who can only access mail server logs and another group which can only access weblogic logs.
The most robust approach is to put each different role's data into its own index. You'd have a "mail" index and a "weblogic" index, and each inputs.conf stanza would explicitly say index=<foo>. Then, you configure each role as to the index(es) it's allowed to use, and drop the users into the proper roles .... and Bob's your uncle.