I've recently added some configuration that creates indexes for data. Each index has a corresponding role that adds both access to and search-by-default for the defined index. Let's suppose one index is called 'testing' and the other is called 'weblogs'.
Users in the 'testing' role can see data in the 'testing' index, and users in the 'weblogs' role can see data in the 'weblogs' index. However, a user in only the admin role, for which the allowed indexes are "all non-internal indexes", can see data in 'testing' but NOT in 'weblogs'.
The config files are generated from the same template, and btool on search heads and indexers shows that they are the same except for the index/role name.
I've yet to have any luck searching up a reason why this is the case. I'm okay with either outcome, but I don't understand why one index is behaving one way, and the other is behaving differently. How can I tell what's causing the difference?
These are on different search heads? Verify that the admin role is set up correctly on the one where it cannot see the index. Admin should be able to see all indexes, and by the way, you should NOT be okay with any other result.
I am okay with the other result in that, these indexes should be access-restricted and I'd prefer if that access was not present on admins by default (but expect that to implement that, I'd need to remove the * for the default searchable indexes - so the expected behavior here is I can see all the data)