we just upgraded from splunk enterprise 7.0.2 to 7.3.1. the gui for assigning indizes has changed and now we see a different behaviour for roles having assigned a lot of indexes (100+).
issue: when configureing a role in the webgui (settings | access controls | roles) which has assigned more than 100 indizes, only the the first 100 entries are shown/configureable. splunk even went so far as to cleanup our authorize.conf after the update (deleting indizes from this role).
we plan to consolidate those assignments it and let ('fat') roles inherit from several others (newly created) to reduce the directly assigned numbers of indexes. still, is there a quick fix? is there a hard limit configureable? where would that be?
thanks in advance, florian
