<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Indexes are randomly removed from roles in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Indexes-are-randomly-removed-from-roles/m-p/578912#M102200</link>
    <description>&lt;P&gt;Hi everyone,&lt;BR /&gt;&lt;BR /&gt;Currently we're dealing with an odd one on the Enterprise search head (we're using 8.2.3).&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;We have multiple roles which grant access to certain indexes to search into, and sometimes randomly, people in the company start complaining that their searches are forbidden. After doing some quick investigation I've seen that in the roles the guys are having, from their (let's say for example sake) 5 allowed indexes, one was being unchecked (i.e. removed).&lt;BR /&gt;&lt;BR /&gt;Do you know why this behavior is happening?&lt;BR /&gt;&lt;BR /&gt;Cheers,&lt;BR /&gt;Darius&lt;/P&gt;</description>
    <pubDate>Mon, 20 Dec 2021 13:11:55 GMT</pubDate>
    <dc:creator>DariusCrisan</dc:creator>
    <dc:date>2021-12-20T13:11:55Z</dc:date>
    <item>
      <title>Indexes are randomly removed from roles</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Indexes-are-randomly-removed-from-roles/m-p/578912#M102200</link>
      <description>&lt;P&gt;Hi everyone,&lt;BR /&gt;&lt;BR /&gt;Currently we're dealing with an odd one on the Enterprise search head (we're using 8.2.3).&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;We have multiple roles which grant access to certain indexes to search into, and sometimes randomly, people in the company start complaining that their searches are forbidden. After doing some quick investigation I've seen that in the roles the guys are having, from their (let's say for example sake) 5 allowed indexes, one was being unchecked (i.e. removed).&lt;BR /&gt;&lt;BR /&gt;Do you know why this behavior is happening?&lt;BR /&gt;&lt;BR /&gt;Cheers,&lt;BR /&gt;Darius&lt;/P&gt;</description>
      <pubDate>Mon, 20 Dec 2021 13:11:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Indexes-are-randomly-removed-from-roles/m-p/578912#M102200</guid>
      <dc:creator>DariusCrisan</dc:creator>
      <dc:date>2021-12-20T13:11:55Z</dc:date>
    </item>
    <item>
      <title>Re: Indexes are randomly removed from roles</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Indexes-are-randomly-removed-from-roles/m-p/578980#M102208</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;&lt;P&gt;at least earlier there was cases when users authenticated towards AD with LDAP and they have “too” many groups or there are “too” many users there could be this kind of issues. Just update ldap connection parameters to accept enough responses and/or limit result set with better matching base filters etc.&lt;/P&gt;&lt;P&gt;r. Ismo&lt;/P&gt;</description>
      <pubDate>Mon, 20 Dec 2021 21:38:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Indexes-are-randomly-removed-from-roles/m-p/578980#M102208</guid>
      <dc:creator>isoutamo</dc:creator>
      <dc:date>2021-12-20T21:38:22Z</dc:date>
    </item>
  </channel>
</rss>

