Indexes are not available to select from "Available search indexes" during role creation since upgrade to 7.0.0

[fboeje]

Since upgrading to splunk 7.0.0 I am not able to select our indexes from our indexcluster from "Available search indexes" during user role creation in the Splunk web gui. The indexes do exist and the Index-Role authorization is still working well using the authorize.conf files within the searchhead cluster.
I have seen this has been a bug in the early versions of Splunk 6 and this looks like the same issue.
Has anyone experienced this issue, before or in Splunk 7.0 ?

[rjteh_splunk]

Splunk has identified this issue in SPL-145546, it is only a problem with the UI, so you should still be able to use authorize.conf to assign the index(es) to role(s). To temporarily workaround the issue, please follow the steps below.

Workaround:

Step 1) Create a local directory in the search app on the SH with the correct permissions for splunkd to access i.e.

$SPLUNK_HOME/etc/apps/search/local/data/ui/manager

Step 2) Copy an old "authentication_roles.xml" file from "$SPLUNK_HOME/etc/apps/search/default/data/ui/manager" in any 6.x version or simply download a new 6.x version of Splunk and extract the file there, then place it into the folder created in step 1.

Step 3) Refresh the SH configuration with debug refresh via the web browser:

http://:8000/en-US/debug/refresh

Step 4) Create a new role on the SH and you should see all your indexes configured on the index cluster.

Note: In the workaround provided above, there is a known issue (SPL-146171) where only 1000 indexes is displayed in the UI. If you have more than 1000 indexes, you should modify authorize.conf to add the index(es) to role(s) instead

[duartet]

Yes it worked!

I got the authorize.conf from 6.6.3 version and placed it on the $SPLUNK_HOME/etc/apps/search/local/data/ui/manager folder and it fixed the issue after I debug/refreshed splunk Search Head.

Thanks!

P.S. - I also had an issue while upgrading from 6.6.3 to 7.0.1 where I couldn't make any search. The fix was to enable Distributed Search again and restart the Search Head. The fix is here explained: https://answers.splunk.com/answers/208043/unable-to-run-any-search-query-warn-search-filters.html

[jimt_mt]

Same here. Upgrade from 6.6.3 to 7.0.0.

[witski]

I have the same issue, too.
I have several testing environments.
My 6.6.3 environment works fine. The searchhead can list all non-internal indexes in 'Available search indexes' column when I edit/create new roles.
But my 7.0.0 environment can't list non-internal indexes by their names.
Both environments have no local/indexes.conf which exists on the indexers.

[auradk]

I have the exact same issue right after upgrade to 7.0
- 1 Searchhead
- 2 Clustered Indexers

[auradk]

I have a support case running on the issue.