I'd like to restrict a certain group of users to only see a specific set of hosts within an index. I can set up the filtering strings using the Roles page of the Splunk Manager. Now I need to change that filter string, or perhaps my user has said that they can't see the results they expect.
How can I triage the filter string tied to a role? Is there some log file somewhere that logs the string that was applied (i.e., that logs the whole search string)? The user's search history doesn't seem to contain the filter strings. Furthermore, if I'm using ActiveDirectory for the user authentication, is there any caching of the role data, specifically the filter strings themselves?