Getting Data In

User can see data in one index but not another with the same config

krisreeves
Path Finder

I've recently added some configuration that creates indexes for data. Each index has a corresponding role that adds both access to and search-by-default for the defined index. Let's suppose one index is called 'testing' and the other is called 'weblogs'.

Users in the 'testing' role can see data in the 'testing' index, and users in the 'weblogs' role can see data in the 'weblogs' index. However, a user in only the admin role, for which the allowed indexes are "all non-internal indexes", can see data in 'testing' but NOT in 'weblogs'.

The config files are generated from the same template, and btool on search heads and indexers shows that they are the same except for the index/role name.

I've yet to have any luck searching up a reason why this is the case. I'm okay with either outcome, but I don't understand why one index is behaving one way, and the other is behaving differently. How can I tell what's causing the difference?

0 Karma
1 Solution

krisreeves
Path Finder

I'm not sure what was going on here, but the data seems visible to me now. Something of a glitch in the matrix, I guess...

View solution in original post

0 Karma

krisreeves
Path Finder

I'm not sure what was going on here, but the data seems visible to me now. Something of a glitch in the matrix, I guess...

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

These are on different search heads? Verify that the admin role is set up correctly on the one where it cannot see the index. Admin should be able to see all indexes, and by the way, you should NOT be okay with any other result.

0 Karma

krisreeves
Path Finder

These are on the same search head.

I am okay with the other result in that, these indexes should be access-restricted and I'd prefer if that access was not present on admins by default (but expect that to implement that, I'd need to remove the * for the default searchable indexes - so the expected behavior here is I can see all the data)

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>