In the documentation about using summary indexes it says at step 8:
Select a summary index. The default
summary index is named summary. The
list only displays indexes to which
you have permission to write. [...]
It seems the last bit "only displays indexes to which you have permission to write" is a bit off.
Our users see the correct summary index on a random basis: Sometimes they see them, sometimes not. We could not determine what's causing this undeterministic behaviour.
So how do I configure a role to have permissions to write to a dedicated index? (obviously without allowing them to write to all other indexes)
"nondeterministic" is an unnecessary presupposition. The term "search head cluster" is sufficient to provide many potential explanations for some apparently arbitrary behavior. Let's explore that issue a bit.
How are you provisioning your search heads? Are you using a home grown solution, manual action, or a deployer?
They're configured both by puppet (configuration management) and by manual actions, e.g. when creating a new role we use Splunk Web.
The indexes.conf file, as it is needed by both search head and index cluster, is deployed by puppet. After a puppet run we manually initiate a rolling restart.
i think, (and i might be wrong) that what you are looking for, "how do I configure a role to have permissions to write to a dedicated index?" does not exist.
Splunk indexes are open for data from all (roles) users (who can use
collect or allowed to schedule a search) out of the box, the
power role has the
si and schedule search capabilities and the admin has the:
run_collect capability, see here:
i am not a big fan of the manual option: save as -> summary index -> choose index
imho its better to create a role with the
run_collect capability and tell the users the name of the new / relevant summary index.
I also believe that the option for configuring write permissions does not exist. However, and because it was documented, I wanted to make sure I didn't miss it.
Yes, si* and collect may work (as no unpopulated dropdown can hinder the creation) but they have the downside that events will be indexed multiple times if the user opens the search manually.