Knowledge Management

Allowing a role to write to a non-standard summary index

willthames2
Path Finder

I have created a new summary index (let's call it summary_example) so that we can use it in an app as a destination for summary indexing.

I have given the appropriate role read access to the index, but it doesn't show up in the dropdown when enabling summary indexing for a saved search. If I do it using an admin user, it does show up.

This suggests that there is either a permission I can grant to allow write access to the summary index by the role, or a capability that the role should have to allow it to write to all summary indexes (I'd prefer the former for obvious reasons)

yannK
Splunk Employee
Splunk Employee

The new index has to be visible to the new role :

in the manager > access control > role

  • verify that the index is in the list of the "searchable indexes" (not necessarily in the "indexes searches by default" list)
  • that the role inherit from power or has the capability "schedule_search"
    • that our new index do not has CAPS or exotic characters in the name.

Other remark, if you have a distributed search and the summary index defined on the indexers (but not on the search-head), please define it also in the search-head to have it accessible in the lists (and setup your search-head to forward the events to the indexers is you want to store the results on the indexers)

0 Karma

spock_yh
Path Finder

Did you manage to find a solution to this issue? I've just encountered it as well

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...