<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Allowing a role to write to a non-standard summary index in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Allowing-a-role-to-write-to-a-non-standard-summary-index/m-p/85696#M869</link>
    <description>&lt;P&gt;The new index has to be visible to the new role :&lt;/P&gt;

&lt;P&gt;in the manager &amp;gt; access control &amp;gt; role &lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt; verify that the index is in the list of the "searchable indexes" (not necessarily in the "indexes searches by default" list) &lt;/LI&gt;
&lt;LI&gt;that the role inherit from power or has the capability "schedule_search"

&lt;UL&gt;
&lt;LI&gt;that our new index do not has CAPS or exotic characters in the name.&lt;/LI&gt;
&lt;/UL&gt;&lt;/LI&gt;
&lt;/UL&gt;

&lt;P&gt;Other remark, if you have a distributed search and the summary index defined on the indexers (but not on the search-head), please define it also in the search-head to have it accessible in the lists (and setup your search-head to forward the events to the indexers is you want to store the results on the indexers)&lt;/P&gt;</description>
    <pubDate>Tue, 12 Mar 2013 21:40:30 GMT</pubDate>
    <dc:creator>yannK</dc:creator>
    <dc:date>2013-03-12T21:40:30Z</dc:date>
    <item>
      <title>Allowing a role to write to a non-standard summary index</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Allowing-a-role-to-write-to-a-non-standard-summary-index/m-p/85694#M867</link>
      <description>&lt;P&gt;I have created a new summary index (let's call it summary_example) so that we can use it in an app as a destination for summary indexing. &lt;/P&gt;

&lt;P&gt;I have given the appropriate role read access to the index, but it doesn't show up in the dropdown when enabling summary indexing for a saved search. If I do it using an admin user, it does show up. &lt;/P&gt;

&lt;P&gt;This suggests that there is either a permission I can grant to allow write access to the summary index by the role, or a capability that the role should have to allow it to write to all summary indexes (I'd prefer the former for obvious reasons)&lt;/P&gt;</description>
      <pubDate>Thu, 28 Jun 2012 01:56:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Allowing-a-role-to-write-to-a-non-standard-summary-index/m-p/85694#M867</guid>
      <dc:creator>willthames2</dc:creator>
      <dc:date>2012-06-28T01:56:54Z</dc:date>
    </item>
    <item>
      <title>Re: Allowing a role to write to a non-standard summary index</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Allowing-a-role-to-write-to-a-non-standard-summary-index/m-p/85695#M868</link>
      <description>&lt;P&gt;Did you manage to find a solution to this issue? I've just encountered it as well&lt;/P&gt;</description>
      <pubDate>Wed, 01 Aug 2012 12:01:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Allowing-a-role-to-write-to-a-non-standard-summary-index/m-p/85695#M868</guid>
      <dc:creator>spock_yh</dc:creator>
      <dc:date>2012-08-01T12:01:21Z</dc:date>
    </item>
    <item>
      <title>Re: Allowing a role to write to a non-standard summary index</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Allowing-a-role-to-write-to-a-non-standard-summary-index/m-p/85696#M869</link>
      <description>&lt;P&gt;The new index has to be visible to the new role :&lt;/P&gt;

&lt;P&gt;in the manager &amp;gt; access control &amp;gt; role &lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt; verify that the index is in the list of the "searchable indexes" (not necessarily in the "indexes searches by default" list) &lt;/LI&gt;
&lt;LI&gt;that the role inherit from power or has the capability "schedule_search"

&lt;UL&gt;
&lt;LI&gt;that our new index do not has CAPS or exotic characters in the name.&lt;/LI&gt;
&lt;/UL&gt;&lt;/LI&gt;
&lt;/UL&gt;

&lt;P&gt;Other remark, if you have a distributed search and the summary index defined on the indexers (but not on the search-head), please define it also in the search-head to have it accessible in the lists (and setup your search-head to forward the events to the indexers is you want to store the results on the indexers)&lt;/P&gt;</description>
      <pubDate>Tue, 12 Mar 2013 21:40:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Allowing-a-role-to-write-to-a-non-standard-summary-index/m-p/85696#M869</guid>
      <dc:creator>yannK</dc:creator>
      <dc:date>2013-03-12T21:40:30Z</dc:date>
    </item>
  </channel>
</rss>

