Is it necessary to create indices, both on Search Head and Indexer?


Hello guys,
After creating my indices in the Indexer and configure it as a search peer of my Search Head, I was able to search through every index that I've created in the Indexer.
BUUUT, when defining a role in the Search Head, I can't limit those indices because the index list only shows the Search Head indices.... Is there any way to resolve this, without duplicating these indices on the Search Head?
Thanks in advance 🙂

0 Karma

Esteemed Legend

Yes, if you would like to use the user/role settings for index values AND like to have the in-search helps know about and suggest index values, then you must define them on the Search Head, too.

0 Karma

Revered Legend

If you want to edit role's index restriction from Splunk Web UI, you'd need those indexes to be created in Search Heads as well. Alternative to this would be setup role using configuration files on Search Head, where you can just mention the name of the indexes that are available in Indexers, without having them created in SH. See this:

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...