1: 先看官方文档,文章最下面有截图实例
Manage role inheritance, searched indexes, restrictions, and available search resources
When you add and edit roles, you can modify the following role properties:
-
You can manage role inheritance. See "Specify role inheritance" in this topic.
-
You can manage the indexes that a role has available to it as well as which indexes the Splunk platform searches by default. See "Specify searchable indexes for a role" in this topic.
-
You can apply a search filter to further limit search results. You can either specify the filter manually or use the search filter generator - a wizard that lets you build and populate the filter by using indexed fields and values found in those indexes. See "Specify search restrictions for a role" in this topic.
- You can control resource usage on the platform in several ways. See "Specify default app and search limits fo