topic Indexes are not visible for adding them to a role on a Splunk SearchHead in Security

Indexes are not visible for adding them to a role on a Splunk SearchHead

kochera — Fri, 28 Oct 2011 12:47:04 GMT

Hi,

If I'm configuring roles directly in the authorize.conf everything works fine. I assign indexes to a role and the user is able to search as expected.
For some reason if I do the same thing via GUI on the Searchhead I'don't see all of my available indexes even worse, as soon as I change a role via GUI, my indexes disappear in the authorize.conf. Any idea what might be the problem?

Searchhead is running Splunk 4.2.3, the indexers are running Splunk 4.2.4

cheers.
Andy

Re: Indexes are not visible for adding them to a role on a Splunk SearchHead

mikelanghorst — Mon, 31 Oct 2011 18:21:34 GMT

Do those indexes exist locally on the searchhead? I'm pretty sure it only looks to the locally configured indexes. You can create them even if there will be no data sent to these indexes on the search head.

Re: Indexes are not visible for adding them to a role on a Splunk SearchHead

kochera — Tue, 01 Nov 2011 06:43:12 GMT

Hi Mike,

no, the indexes do not exist on the searchhead. Nevertheless I see indexes from the indexers (6) on the searchhead, just not all of them.

cheers,
Andy