If I'm understanding you correctly, if a sourcetype is sending information to two seperate indexes, such as index=WinEvents and index=WebEvents, and the user role is limited to only see the WinEvents index, hosts that have data sent to another index will not be displayed for the users? Example below.
Sourcetype=WinEvents:Security
Hosts = (Generic-DC1, Generic-Server1, Generic-Server2, Desktop1, Desktop2, Desktop3)
Sourcetype=WebEvents:Outbound
Hosts = (Generic-Server2, Desktop1, Desktop2, Desktop3)
For the above information, would the user role in question only see the two hosts: Generic-DC1 and Generic-Server1 since they are not permitted to see the WebEvents index?
... View more