Indexes are not visible for adding them to a role on a Splunk SearchHead

[kochera]

Hi,

If I'm configuring roles directly in the authorize.conf everything works fine. I assign indexes to a role and the user is able to search as expected.
For some reason if I do the same thing via GUI on the Searchhead I'don't see all of my available indexes even worse, as soon as I change a role via GUI, my indexes disappear in the authorize.conf. Any idea what might be the problem?

Searchhead is running Splunk 4.2.3, the indexers are running Splunk 4.2.4

cheers.
Andy

[mikelanghorst]

Do those indexes exist locally on the searchhead? I'm pretty sure it only looks to the locally configured indexes. You can create them even if there will be no data sent to these indexes on the search head.

[kochera]

Hi Mike,

no, the indexes do not exist on the searchhead. Nevertheless I see indexes from the indexers (6) on the searchhead, just not all of them.

cheers,
Andy