Security

Why can't I get a role to query _internal?

verbal_666
Builder

It's making me crazy!!! 😡😡😡😡😡

Splunk Enterprise 8.2.6, Cluster SH with 3 members.

 

 

[role_test]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
grantableRoles = test
importRoles = user
srchIndexesAllowed = *;_*
srchMaxTime = 8640000

 

 

A "test" new Role. Import capabilities from "user" Role. A new user is assigner to the "test" Role.

1.JPG

 

2.JPG

 

3.JPG

 

No way to query _internal indexes!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 😤😤😤

Any suggestion??? 🤔

Thanks.

Labels (1)
0 Karma

verbal_666
Builder

Solved with a SH Cluster members full restart... gosh!!! Strage to me... ... ... 🤔

Maybe Cluster was not correcly in sync... 🙄

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...