Security

Indexes are not available to select from "Available search indexes" during role creation since upgrade to 7.0.0

fboeje
Explorer

Since upgrading to splunk 7.0.0 I am not able to select our indexes from our indexcluster from "Available search indexes" during user role creation in the Splunk web gui. The indexes do exist and the Index-Role authorization is still working well using the authorize.conf files within the searchhead cluster.
I have seen this has been a bug in the early versions of Splunk 6 and this looks like the same issue.
Has anyone experienced this issue, before or in Splunk 7.0 ?

rjteh_splunk
Splunk Employee
Splunk Employee

Splunk has identified this issue in SPL-145546, it is only a problem with the UI, so you should still be able to use authorize.conf to assign the index(es) to role(s). To temporarily workaround the issue, please follow the steps below.

Workaround:

Step 1) Create a local directory in the search app on the SH with the correct permissions for splunkd to access i.e.

$SPLUNK_HOME/etc/apps/search/local/data/ui/manager

Step 2) Copy an old "authentication_roles.xml" file from "$SPLUNK_HOME/etc/apps/search/default/data/ui/manager" in any 6.x version or simply download a new 6.x version of Splunk and extract the file there, then place it into the folder created in step 1.

Step 3) Refresh the SH configuration with debug refresh via the web browser:

http://:8000/en-US/debug/refresh

Step 4) Create a new role on the SH and you should see all your indexes configured on the index cluster.

Note: In the workaround provided above, there is a known issue (SPL-146171) where only 1000 indexes is displayed in the UI. If you have more than 1000 indexes, you should modify authorize.conf to add the index(es) to role(s) instead

duartet
Path Finder

Yes it worked!

I got the authorize.conf from 6.6.3 version and placed it on the $SPLUNK_HOME/etc/apps/search/local/data/ui/manager folder and it fixed the issue after I debug/refreshed splunk Search Head.

Thanks!

P.S. - I also had an issue while upgrading from 6.6.3 to 7.0.1 where I couldn't make any search. The fix was to enable Distributed Search again and restart the Search Head. The fix is here explained: https://answers.splunk.com/answers/208043/unable-to-run-any-search-query-warn-search-filters.html

0 Karma

jimt_mt
Observer

Same here. Upgrade from 6.6.3 to 7.0.0.

0 Karma

witski
Explorer

I have the same issue, too.
I have several testing environments.
My 6.6.3 environment works fine. The searchhead can list all non-internal indexes in 'Available search indexes' column when I edit/create new roles.
But my 7.0.0 environment can't list non-internal indexes by their names.
Both environments have no local/indexes.conf which exists on the indexers.

0 Karma

auradk
Explorer

I have the exact same issue right after upgrade to 7.0
- 1 Searchhead
- 2 Clustered Indexers

0 Karma

auradk
Explorer

I have a support case running on the issue.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...