Splunk Search

[7.3] Index Selection for roles does not show all indexes

sylim_splunk
Splunk Employee
Splunk Employee

upgraded to 7.3 and they can no longer see all 208 indexes that we have when editing roles.
When you edit a role and try to add it as searchable it does not display them all and you can not search for them.

Tags (1)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

This has been fixed in the version 7.3.3+ which is already available for downloading.
You can also implement the workaround below until the upgrade;

** Workaround

  1. Open to edit $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/pages/enterprise/authorization_roles.js
  2. Find the line below; this.indexListSearchJob.getResults().subscribe(function(results)
  3. Add the following between the parentheses which will allow 1000 indexes to be displayed. { count: 1000 } Should be like this: this.indexListSearchJob.getResults({ count: 1000 }).subscribe(function(results)
  4. Save file and hit the _bump endpoint. Click the "Bump version" button to force browser caches to make the change take effect. http(s)://yourSplunk:8000/en-US/_bump We have planned to fix this permanantly by implementing pagination for the list instead of listing up all in one.

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

This has been fixed in the version 7.3.3+ which is already available for downloading.
You can also implement the workaround below until the upgrade;

** Workaround

  1. Open to edit $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/pages/enterprise/authorization_roles.js
  2. Find the line below; this.indexListSearchJob.getResults().subscribe(function(results)
  3. Add the following between the parentheses which will allow 1000 indexes to be displayed. { count: 1000 } Should be like this: this.indexListSearchJob.getResults({ count: 1000 }).subscribe(function(results)
  4. Save file and hit the _bump endpoint. Click the "Bump version" button to force browser caches to make the change take effect. http(s)://yourSplunk:8000/en-US/_bump We have planned to fix this permanantly by implementing pagination for the list instead of listing up all in one.

gjanders
SplunkTrust
SplunkTrust

@sylim_splunk the release notes of 7.3.3 "Index Selection for roles only shows 100 indexes", is it fixed in that version?

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

Thank you for the info,I'm checking. I'll update here once confirmed.

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

Just fixed the version, thanks @gjanders for pointing that out.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...