topic two indexes in Splunk Search

two indexes

LoganRhamy — Thu, 29 Mar 2018 14:23:43 GMT

A power user cannot get results from index=* or index=foo OR index=bar when an admin can

Below is the authorize.conf changes

[role_user]
srchMaxTime = 8640000
srchDiskQuota = 250

[role_admin]
srchIndexesDefault = main
srchMaxTime = 8640000

[role_power]
cumulativeRTSrchJobsQuota = 400
cumulativeSrchJobsQuota = 200
srchFilter = *
srchMaxTime = 8640000

When the power user runs the query they are getting results from foo index but nothing from bar index. When the Power user run index=foo he gets results and when he runs index=bar he gets results.

When the admin user run the query they are getting results from both foo and bar indexes.

Let me know what I might be missing to get the fixed for our power users.

Best regards,
Logan Rhamy

Re: two indexes

tiagofbmm — Thu, 29 Mar 2018 14:32:54 GMT

Hey

The power user with a index=* will get its default indexes, which if you haven;t changed them, are only main. So if you are searching index=* and aren't getting results from one index, it means you may need to add bar index to srchIndexesAllowed for the role power_user.

Re: two indexes

LoganRhamy — Thu, 29 Mar 2018 14:36:44 GMT

Thank you for the quick answer. When Power user searches bar alone he gets results. I assume that would mean he has access to search that index. Let me know if I am mistaken.

Re: two indexes

tiagofbmm — Thu, 29 Mar 2018 14:41:06 GMT

Yes it does mean he can get data from that index indeed. No errors occur in that search? Are you sure both searches time ranges are the same?

Re: two indexes

LoganRhamy — Thu, 29 Mar 2018 14:43:21 GMT

Yes it is a dashboard search that is just opened in search so we are 100% sure of the match query and time frame.

No errors occur besides the lack of results from one of the indexes