It is B per the docs: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/configuration-file-reference/9.4.2-configuration-file-reference/authorize.conf
srchFilterSelecting = <boolean>
* Determines whether a role's search filters are used for selecting or
eliminating during role inheritance.
* If "true", the search filters are used for selecting. The filters are joined
with an OR clause when combined.
...
I think A (AND):
If you use OR, it would mean the user would receive access to all .csv files, even those outside of index=main. The index=main is designed to restrict the user to only the main index, using OR would make this irrelevant.
When multiple search filters are assigned from different roles, Splunk combines them with an OR condition. This means the user will have access to data that matches either of the search filters.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
chkie
2 weeks, 3 days agoc1c8784
4 months, 3 weeks agoqawasmih
11 months agob997bd0
8 months, 2 weeks ago