We have a single indexer aggregating logs from our different teams.... Server, virtualization, Network, etc..... Generally, our teams use different apps. Unfortunately, I have 2 virtualization teams, each with their own Search Head, that use the Server Virtualization App, but from different hosts.
I am trying to figure out how I could filter on the respective search heads automatically so that each team sees only their hosts' data. Since the app uses custom indexes and source-types, I don't see a way to do it at index time. Any suggestions? Can this be done at search time on the search head?
Hi RomeoG,
Since you have already indexed the data in same index, create / update the roles with "Restrict search terms " parameter.
This may help you.