Getting Data In

Indexes are randomly removed from roles

DariusCrisan
New Member

Hi everyone,

Currently we're dealing with an odd one on the Enterprise search head (we're using 8.2.3). 

We have multiple roles which grant access to certain indexes to search into, and sometimes randomly, people in the company start complaining that their searches are forbidden. After doing some quick investigation I've seen that in the roles the guys are having, from their (let's say for example sake) 5 allowed indexes, one was being unchecked (i.e. removed).

Do you know why this behavior is happening?

Cheers,
Darius

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

at least earlier there was cases when users authenticated towards AD with LDAP and they have “too” many groups or there are “too” many users there could be this kind of issues. Just update ldap connection parameters to accept enough responses and/or limit result set with better matching base filters etc.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...