Getting Data In

User can see data in one index but not another with the same config

krisreeves
Path Finder

I've recently added some configuration that creates indexes for data. Each index has a corresponding role that adds both access to and search-by-default for the defined index. Let's suppose one index is called 'testing' and the other is called 'weblogs'.

Users in the 'testing' role can see data in the 'testing' index, and users in the 'weblogs' role can see data in the 'weblogs' index. However, a user in only the admin role, for which the allowed indexes are "all non-internal indexes", can see data in 'testing' but NOT in 'weblogs'.

The config files are generated from the same template, and btool on search heads and indexers shows that they are the same except for the index/role name.

I've yet to have any luck searching up a reason why this is the case. I'm okay with either outcome, but I don't understand why one index is behaving one way, and the other is behaving differently. How can I tell what's causing the difference?

0 Karma
1 Solution

krisreeves
Path Finder

I'm not sure what was going on here, but the data seems visible to me now. Something of a glitch in the matrix, I guess...

View solution in original post

0 Karma

krisreeves
Path Finder

I'm not sure what was going on here, but the data seems visible to me now. Something of a glitch in the matrix, I guess...

0 Karma

DalJeanis
Legend

These are on different search heads? Verify that the admin role is set up correctly on the one where it cannot see the index. Admin should be able to see all indexes, and by the way, you should NOT be okay with any other result.

0 Karma

krisreeves
Path Finder

These are on the same search head.

I am okay with the other result in that, these indexes should be access-restricted and I'd prefer if that access was not present on admins by default (but expect that to implement that, I'd need to remove the * for the default searchable indexes - so the expected behavior here is I can see all the data)

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...