populating search unable to select summary index

[Muryoutaisuu]

In the documentation about using summary indexes it says at step 8:

Select a summary index. The default
summary index is named summary. The
list only displays indexes to which
you have permission to write. [...]

It seems the last bit "only displays indexes to which you have permission to write" is a bit off.
Our users see the correct summary index on a random basis: Sometimes they see them, sometimes not. We could not determine what's causing this undeterministic behaviour.

So how do I configure a role to have permissions to write to a dedicated index? (obviously without allowing them to write to all other indexes)

Our specs:

• Index cluster on version 7.1.2 (build a0c72a66db66)
• search head cluster on version 7.1.2 (build a0c72a66db66)
• summary indexes are defined on index & search head cluster

[DalJeanis]

"nondeterministic" is an unnecessary presupposition. The term "search head cluster" is sufficient to provide many potential explanations for some apparently arbitrary behavior. Let's explore that issue a bit.

How are you provisioning your search heads? Are you using a home grown solution, manual action, or a deployer?

[Muryoutaisuu]

They're configured both by puppet (configuration management) and by manual actions, e.g. when creating a new role we use Splunk Web.

The indexes.conf file, as it is needed by both search head and index cluster, is deployed by puppet. After a puppet run we manually initiate a rolling restart.

[adonio]

i think, (and i might be wrong) that what you are looking for, "how do I configure a role to have permissions to write to a dedicated index?" does not exist.
Splunk indexes are open for data from all (roles) users (who can use si*, collect or allowed to schedule a search) out of the box, the power role has the si and schedule search capabilities and the admin has the: run_collect capability, see here:
https://docs.splunk.com/Documentation/Splunk/7.2.0/Security/Rolesandcapabilities#List_of_capabilitie...
i am not a big fan of the manual option: save as -> summary index -> choose index
imho its better to create a role with the run_collect capability and tell the users the name of the new / relevant summary index.

[Muryoutaisuu]

I also believe that the option for configuring write permissions does not exist. However, and because it was documented, I wanted to make sure I didn't miss it.
Yes, si* and collect may work (as no unpopulated dropdown can hinder the creation) but they have the downside that events will be indexed multiple times if the user opens the search manually.