Security

Roles lost from cluster

Path Finder

Hi ,

Its strange something that has happened in our cluster today .
We find all our roles, except a few , missing from the splunk search head .
We did no change but we performed an app upgrade last night where we pushed bundle to the cluster .
Any idea what might have happened that has caused most of the roles to disappear .
And any idea how to recover ?

Thanks,
Shraddha

Tags (1)
0 Karma
1 Solution

Builder

Hi,

Are the roles missing from authorize.conf or just the ui ? Were the roles originally added on an individual SH ?

View solution in original post

0 Karma

Contributor

Hi Shraddha,

I believe you have might pushed the bundle to the cluster through the deployer and you have created your roles locally on your search head. If so, then its high chance that your locally done things have been overwritten with the upgrade that you just did. Regarding the recovery, I don't think there's a way unless you have back up.

Thanks!

0 Karma

Builder

Hi,

Are the roles missing from authorize.conf or just the ui ? Were the roles originally added on an individual SH ?

View solution in original post

0 Karma

Path Finder

all role spresent in authorize.conf , but in ui roles are lost

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!