I'm also curious on how this would work in a slightly different scenario - Search Peering. Where Indexers/CM is in one VPC and SHC/Deployer is in a different VPC. I would also assume you would need a 1-to-1 number of NLB in the Splunk Indexer VPC, and a 1-to-1 PrivateLink in the Splunk SHC VPC for each indexer in the you'd want to connect to.
... View more
Hi! I am running on the same issue as you did but on splunk 8.0.5. No roles are inherited and only search is granted to the user, but the search terms for the restrict search are not working at all and the user can see all the data. https://community.splunk.com/t5/Splunk-Search/Restrict-search-to-a-role-using-a-search-restriction-is-not/m-p/509197#M142301 Thanks in advance.
... View more