topic Re: Not able to search index=_internal from searchead in Getting Data In

Not able to search index=_internal from searchead

eburnett — Mon, 03 May 2021 18:30:53 GMT

I'm trying to do a search against index=_internal but I do not see this index on my searchhead.

I do see it when I do a search from the indexers.

Any suggestions where I should look first to fix this?

Re: Not able to search index=_internal from searchead

s2_splunk — Mon, 03 May 2021 20:27:59 GMT

Sounds like your user role doesn't have permission to look at internal indices?

Re: Not able to search index=_internal from searchead

gcusello — Tue, 04 May 2021 06:52:22 GMT

Hi @eburnett,

at first sight the problem seems to be the one indicated by @s2_splunk.

In addition, you could check if you're sending internal logs from all your Splunk servers to the Indexer (this is a best practice for distributed architectures).

You can do this forwarding logs from all your Splunk Servers (also Search Heads) to the Indexer [Settings -- Forwardring and Receiving -- Forward].

Ciao.

Giuseppe

Re: Not able to search index=_internal from searchead

eburnett — Mon, 10 May 2021 17:58:05 GMT

So I tried to do this search with admin account and you are correct I can see results from this search then. index=_internal*

So Do I need to change permissions somewhere to see these with a user account?

Re: Not able to search index=_internal from searchead

s2_splunk — Wed, 12 May 2021 16:01:37 GMT

Yes, you will need to provide access to indices as needed by role (not user). Please review docs how to go about it.