Security

7.3.1: max. number of indizes assigned to a role = 100

splunk_arz
Explorer

we just upgraded from splunk enterprise 7.0.2 to 7.3.1. the gui for assigning indizes has changed and now we see a different behaviour for roles having assigned a lot of indexes (100+).

issue: when configureing a role in the webgui (settings | access controls | roles) which has assigned more than 100 indizes, only the the first 100 entries are shown/configureable. splunk even went so far as to cleanup our authorize.conf after the update (deleting indizes from this role).

we plan to consolidate those assignments it and let ('fat') roles inherit from several others (newly created) to reduce the directly assigned numbers of indexes. still, is there a quick fix? is there a hard limit configureable? where would that be?

thanks in advance, florian

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...