Use the getSearchFilter function to filter at search time

This function is optional and can be used to implement a user-based filter at search time. When getSearchFilter is enabled, Splunk software calls it every time a search is run. A user-based search filter supplements any filters specified for that user's role(s). The returned filter(s) will be applied to each search, along with any configured at the role level. Caching of the filter does not occur with this function.

Note: User-based search filters are optional and not recommended. A better approach is to assign search filters to roles and then assign users to the appropriate roles.

To enable getSearchFilter function, set the scriptSearchFilters parameter in authentication.conf:

[script]
scriptPath = $SPLUNK_HOME/bin/python $SPLUNK_HOME/bin/<scriptname.py>
scriptSearchFilters = 1

Note: In previous releases, getSearchFilter could also be used to implement search filters for users who had been authenticated by Splunk software. Starting with 4.2, getSearchFilter is called only for users who have been authenticated by scripted authorization.

In addition, if a call to getSearchFilter fails, Splunk Enterprise will cancel the user's search and return an error message, to ensure that users cannot view results from unauthorized searches.