Knowledge Management

populating search unable to select summary index

Communicator

In the documentation about using summary indexes it says at step 8:

Select a summary index. The default
summary index is named summary. The
list only displays indexes to which
you have permission to write. [...]

It seems the last bit "only displays indexes to which you have permission to write" is a bit off.
Our users see the correct summary index on a random basis: Sometimes they see them, sometimes not. We could not determine what's causing this undeterministic behaviour.

So how do I configure a role to have permissions to write to a dedicated index? (obviously without allowing them to write to all other indexes)

Our specs:

  • Index cluster on version 7.1.2 (build a0c72a66db66)
  • search head cluster on version 7.1.2 (build a0c72a66db66)
  • summary indexes are defined on index & search head cluster
0 Karma

SplunkTrust
SplunkTrust

"nondeterministic" is an unnecessary presupposition. The term "search head cluster" is sufficient to provide many potential explanations for some apparently arbitrary behavior. Let's explore that issue a bit.

How are you provisioning your search heads? Are you using a home grown solution, manual action, or a deployer?

0 Karma

Communicator

They're configured both by puppet (configuration management) and by manual actions, e.g. when creating a new role we use Splunk Web.

The indexes.conf file, as it is needed by both search head and index cluster, is deployed by puppet. After a puppet run we manually initiate a rolling restart.

0 Karma

SplunkTrust
SplunkTrust

i think, (and i might be wrong) that what you are looking for, "how do I configure a role to have permissions to write to a dedicated index?" does not exist.
Splunk indexes are open for data from all (roles) users (who can use si*, collect or allowed to schedule a search) out of the box, the power role has the si and schedule search capabilities and the admin has the: run_collect capability, see here:
https://docs.splunk.com/Documentation/Splunk/7.2.0/Security/Rolesandcapabilities#List_of_capabilitie...
i am not a big fan of the manual option: save as -> summary index -> choose index
imho its better to create a role with the run_collect capability and tell the users the name of the new / relevant summary index.

0 Karma

Communicator

I also believe that the option for configuring write permissions does not exist. However, and because it was documented, I wanted to make sure I didn't miss it.
Yes, si* and collect may work (as no unpopulated dropdown can hinder the creation) but they have the downside that events will be indexed multiple times if the user opens the search manually.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!