Knowledge Management

populating search unable to select summary index

Muryoutaisuu
Communicator

In the documentation about using summary indexes it says at step 8:

Select a summary index. The default
summary index is named summary. The
list only displays indexes to which
you have permission to write. [...]

It seems the last bit "only displays indexes to which you have permission to write" is a bit off.
Our users see the correct summary index on a random basis: Sometimes they see them, sometimes not. We could not determine what's causing this undeterministic behaviour.

So how do I configure a role to have permissions to write to a dedicated index? (obviously without allowing them to write to all other indexes)

Our specs:

  • Index cluster on version 7.1.2 (build a0c72a66db66)
  • search head cluster on version 7.1.2 (build a0c72a66db66)
  • summary indexes are defined on index & search head cluster
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

"nondeterministic" is an unnecessary presupposition. The term "search head cluster" is sufficient to provide many potential explanations for some apparently arbitrary behavior. Let's explore that issue a bit.

How are you provisioning your search heads? Are you using a home grown solution, manual action, or a deployer?

0 Karma

Muryoutaisuu
Communicator

They're configured both by puppet (configuration management) and by manual actions, e.g. when creating a new role we use Splunk Web.

The indexes.conf file, as it is needed by both search head and index cluster, is deployed by puppet. After a puppet run we manually initiate a rolling restart.

0 Karma

adonio
Ultra Champion

i think, (and i might be wrong) that what you are looking for, "how do I configure a role to have permissions to write to a dedicated index?" does not exist.
Splunk indexes are open for data from all (roles) users (who can use si*, collect or allowed to schedule a search) out of the box, the power role has the si and schedule search capabilities and the admin has the: run_collect capability, see here:
https://docs.splunk.com/Documentation/Splunk/7.2.0/Security/Rolesandcapabilities#List_of_capabilitie...
i am not a big fan of the manual option: save as -> summary index -> choose index
imho its better to create a role with the run_collect capability and tell the users the name of the new / relevant summary index.

0 Karma

Muryoutaisuu
Communicator

I also believe that the option for configuring write permissions does not exist. However, and because it was documented, I wanted to make sure I didn't miss it.
Yes, si* and collect may work (as no unpopulated dropdown can hinder the creation) but they have the downside that events will be indexed multiple times if the user opens the search manually.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...