Deployment Architecture
Highlighted

How come our indexes are missing in our search head cluster?

Path Finder

We have a Search Head Cluster. The three search head cluster (SHC) members have the Indexers listed in the Search Peer.

Everything looks good configuration wise but none of our existing indexes (we had a standalone search head we are using while we set up the SHC) are available to select when accessing a role or creating a new role.

I thought there was an article about this in Splunk Answers yesterday, but I could not find it again.

Any help is appreciated.

Thx

0 Karma
Highlighted

Re: How come our indexes are missing in our search head cluster?

Communicator

This was fixed in 7.0.8 and recent releases of 7.2. To workaround this in earlier versions, either add the indexes to your search head or go grab an authorize_roles.xml from a 6.x version and deploy it to your SHC manually in etc/apps/search/local/data/ui/manager

https://docs.splunk.com/Documentation/Splunk/7.0.8/ReleaseNotes/Fixedissues#Splunk_Web_and_interface...

Highlighted

Re: How come our indexes are missing in our search head cluster?

Path Finder

Thanks for the information.
Where can i get a copy of a version 6 authorize_roles.xml file?

0 Karma