Security

Indexes are not available to select from "Available search indexes" during role creation since upgrade to 7.0.0

fboeje
Explorer

Since upgrading to splunk 7.0.0 I am not able to select our indexes from our indexcluster from "Available search indexes" during user role creation in the Splunk web gui. The indexes do exist and the Index-Role authorization is still working well using the authorize.conf files within the searchhead cluster.
I have seen this has been a bug in the early versions of Splunk 6 and this looks like the same issue.
Has anyone experienced this issue, before or in Splunk 7.0 ?

rjteh_splunk
Splunk Employee
Splunk Employee

Splunk has identified this issue in SPL-145546, it is only a problem with the UI, so you should still be able to use authorize.conf to assign the index(es) to role(s). To temporarily workaround the issue, please follow the steps below.

Workaround:

Step 1) Create a local directory in the search app on the SH with the correct permissions for splunkd to access i.e.

$SPLUNK_HOME/etc/apps/search/local/data/ui/manager

Step 2) Copy an old "authentication_roles.xml" file from "$SPLUNK_HOME/etc/apps/search/default/data/ui/manager" in any 6.x version or simply download a new 6.x version of Splunk and extract the file there, then place it into the folder created in step 1.

Step 3) Refresh the SH configuration with debug refresh via the web browser:

http://:8000/en-US/debug/refresh

Step 4) Create a new role on the SH and you should see all your indexes configured on the index cluster.

Note: In the workaround provided above, there is a known issue (SPL-146171) where only 1000 indexes is displayed in the UI. If you have more than 1000 indexes, you should modify authorize.conf to add the index(es) to role(s) instead

duartet
Path Finder

Yes it worked!

I got the authorize.conf from 6.6.3 version and placed it on the $SPLUNK_HOME/etc/apps/search/local/data/ui/manager folder and it fixed the issue after I debug/refreshed splunk Search Head.

Thanks!

P.S. - I also had an issue while upgrading from 6.6.3 to 7.0.1 where I couldn't make any search. The fix was to enable Distributed Search again and restart the Search Head. The fix is here explained: https://answers.splunk.com/answers/208043/unable-to-run-any-search-query-warn-search-filters.html

0 Karma

jimt_mt
Loves-to-Learn

Same here. Upgrade from 6.6.3 to 7.0.0.

0 Karma

witski
Explorer

I have the same issue, too.
I have several testing environments.
My 6.6.3 environment works fine. The searchhead can list all non-internal indexes in 'Available search indexes' column when I edit/create new roles.
But my 7.0.0 environment can't list non-internal indexes by their names.
Both environments have no local/indexes.conf which exists on the indexers.

0 Karma

auradk
Path Finder

I have the exact same issue right after upgrade to 7.0
- 1 Searchhead
- 2 Clustered Indexers

0 Karma

auradk
Path Finder

I have a support case running on the issue.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...