Security

Why can't I get a role to query _internal?

verbal_666
Builder

It's making me crazy!!! 😡😡😡😡😡

Splunk Enterprise 8.2.6, Cluster SH with 3 members.

 

 

[role_test]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
grantableRoles = test
importRoles = user
srchIndexesAllowed = *;_*
srchMaxTime = 8640000

 

 

A "test" new Role. Import capabilities from "user" Role. A new user is assigner to the "test" Role.

1.JPG

 

2.JPG

 

3.JPG

 

No way to query _internal indexes!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 😤😤😤

Any suggestion??? 🤔

Thanks.

Labels (1)
0 Karma

verbal_666
Builder

Solved with a SH Cluster members full restart... gosh!!! Strage to me... ... ... 🤔

Maybe Cluster was not correcly in sync... 🙄

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...