About srchFilter

srchFilter = <string>

• A list of search filters for this role.
• Users who hold this role have their searches filtered by the expression provided by this setting.
• The value for this setting can contain one or more of the following terms:
  • source=
  • host= and host tags
  • index= and index names
  • eventtype= and event type tags
  • sourcetype=
  • search fields
  • wildcards
• You can use the AND and OR operators to include multiple terms or make searches more restrictive.
• The value for this setting can't be any of the following:
  • saved searches
  • time operators
  • regular expressions
  • any fields or modifiers Splunk Web can overwrite
• To override any search filters from imported roles, give this setting a value of *, as the admin role does.
• Default: empty string (the Splunk platform does not perform search filtering).

View authorize.conf reference