It's making me crazy!!! 😡😡😡😡😡
Splunk Enterprise 8.2.6, Cluster SH with 3 members.
[role_test]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
grantableRoles = test
importRoles = user
srchIndexesAllowed = *;_*
srchMaxTime = 8640000
A "test" new Role. Import capabilities from "user" Role. A new user is assigner to the "test" Role.
No way to query _internal indexes!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 😤😤😤
Any suggestion??? 🤔
Thanks.
Solved with a SH Cluster members full restart... gosh!!! Strage to me... ... ... 🤔
Maybe Cluster was not correcly in sync... 🙄