Getting Data In

User can see data in one index but not another with the same config

krisreeves
Path Finder

I've recently added some configuration that creates indexes for data. Each index has a corresponding role that adds both access to and search-by-default for the defined index. Let's suppose one index is called 'testing' and the other is called 'weblogs'.

Users in the 'testing' role can see data in the 'testing' index, and users in the 'weblogs' role can see data in the 'weblogs' index. However, a user in only the admin role, for which the allowed indexes are "all non-internal indexes", can see data in 'testing' but NOT in 'weblogs'.

The config files are generated from the same template, and btool on search heads and indexers shows that they are the same except for the index/role name.

I've yet to have any luck searching up a reason why this is the case. I'm okay with either outcome, but I don't understand why one index is behaving one way, and the other is behaving differently. How can I tell what's causing the difference?

0 Karma
1 Solution

krisreeves
Path Finder

I'm not sure what was going on here, but the data seems visible to me now. Something of a glitch in the matrix, I guess...

View solution in original post

0 Karma

krisreeves
Path Finder

I'm not sure what was going on here, but the data seems visible to me now. Something of a glitch in the matrix, I guess...

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

These are on different search heads? Verify that the admin role is set up correctly on the one where it cannot see the index. Admin should be able to see all indexes, and by the way, you should NOT be okay with any other result.

0 Karma

krisreeves
Path Finder

These are on the same search head.

I am okay with the other result in that, these indexes should be access-restricted and I'd prefer if that access was not present on admins by default (but expect that to implement that, I'd need to remove the * for the default searchable indexes - so the expected behavior here is I can see all the data)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...