topic Re: In the searchhead GUI only 1000 available search indexes are shown in Security

In the searchhead GUI only 1000 available search indexes are shown

devopsaab — Thu, 15 Oct 2020 13:30:19 GMT

In Access Management - Role - available search indexes , only 1000 indexes are shown while we have more than 1000 indexes. Is there a way to increase this limit ?

We run splunk 7.3.3

Re: In the searchhead GUI only 1000 available search indexes are shown

Richfez — Mon, 19 Oct 2020 21:37:19 GMT

TLDR; this is probably "hard coded" into the app. But I put "hard coded" into quotes because it's just javascript and is editable as per the below:

https://community.splunk.com/t5/Archive/7-3-Index-Selection-for-roles-does-not-show-all-indexes/m-p/499861

If that answers your question, please give them a dose of karma as well as this answer!

-Rich

Re: In the searchhead GUI only 1000 available search indexes are shown

devopsaab — Tue, 20 Oct 2020 10:56:05 GMT

I solved this issue by

Placing a splunk 6.x version of authentication_roles.xmlin /opt/splunk/etc/apps/search/local/data/ui/manager/

In this file, the count of "srchIndexesDefault" and "srchIndexesAllowed" can be increased

After changing this file , the file on the searchhead must be reloaded (debug/refresh or splunk restart)