Security

Indexes are not available to select from "Available search indexes" during role creation since upgrade to 7.0.0

fboeje
Explorer

Since upgrading to splunk 7.0.0 I am not able to select our indexes from our indexcluster from "Available search indexes" during user role creation in the Splunk web gui. The indexes do exist and the Index-Role authorization is still working well using the authorize.conf files within the searchhead cluster.
I have seen this has been a bug in the early versions of Splunk 6 and this looks like the same issue.
Has anyone experienced this issue, before or in Splunk 7.0 ?

rjteh_splunk
Splunk Employee
Splunk Employee

Splunk has identified this issue in SPL-145546, it is only a problem with the UI, so you should still be able to use authorize.conf to assign the index(es) to role(s). To temporarily workaround the issue, please follow the steps below.

Workaround:

Step 1) Create a local directory in the search app on the SH with the correct permissions for splunkd to access i.e.

$SPLUNK_HOME/etc/apps/search/local/data/ui/manager

Step 2) Copy an old "authentication_roles.xml" file from "$SPLUNK_HOME/etc/apps/search/default/data/ui/manager" in any 6.x version or simply download a new 6.x version of Splunk and extract the file there, then place it into the folder created in step 1.

Step 3) Refresh the SH configuration with debug refresh via the web browser:

http://:8000/en-US/debug/refresh

Step 4) Create a new role on the SH and you should see all your indexes configured on the index cluster.

Note: In the workaround provided above, there is a known issue (SPL-146171) where only 1000 indexes is displayed in the UI. If you have more than 1000 indexes, you should modify authorize.conf to add the index(es) to role(s) instead

duartet
Path Finder

Yes it worked!

I got the authorize.conf from 6.6.3 version and placed it on the $SPLUNK_HOME/etc/apps/search/local/data/ui/manager folder and it fixed the issue after I debug/refreshed splunk Search Head.

Thanks!

P.S. - I also had an issue while upgrading from 6.6.3 to 7.0.1 where I couldn't make any search. The fix was to enable Distributed Search again and restart the Search Head. The fix is here explained: https://answers.splunk.com/answers/208043/unable-to-run-any-search-query-warn-search-filters.html

0 Karma

jimt_mt
Loves-to-Learn

Same here. Upgrade from 6.6.3 to 7.0.0.

0 Karma

witski
Explorer

I have the same issue, too.
I have several testing environments.
My 6.6.3 environment works fine. The searchhead can list all non-internal indexes in 'Available search indexes' column when I edit/create new roles.
But my 7.0.0 environment can't list non-internal indexes by their names.
Both environments have no local/indexes.conf which exists on the indexers.

0 Karma

auradk
Path Finder

I have the exact same issue right after upgrade to 7.0
- 1 Searchhead
- 2 Clustered Indexers

0 Karma

auradk
Path Finder

I have a support case running on the issue.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...