indexes not visible when splunk has more than 100 indexes when assign them to a role on a slunk searchheader

[Anthony_Hou]

Dear sir,

indexes not visible when splunk has more than 100 indexes when assign them to a role on a slunk searchheader.

Issue happans on Distributed splunk structure and also standalone splunk structure.

we have a splunk search header can distrubte search for 5 splunk indexers.

When create or modify a role, the list of available indexes can not show all of indexes, when total number of indexes are more than 100.

We have a lab for standalone splunk, creating 120 indexes, every index's name are following the order from 1 to 120.
then we just can see about no. 80 indexes in the available list.

We have count the list of available indexes, we found it's only about 100 indexes and nothing more!

Is this a bug ?

Thanks for anyone have the answer.

tks,
Anthony Hou

[Simeon · Accepted solution]

There may be a limitation in the UI for the visible indexes available. There WAS a bug in older versions, where the length of parameters in authorize.conf would cause problems (not be applied). I recommend you log a case with support and check your version release notes.

[Anthony_Hou]

Dear Simeon,
thank you for the reply.
issue still on 4.2.5 splunk
The splunk support in our area has replied this morning. They said this is the limitation of the design. It seems not easy to have a hotfix for this issue, but they will try, I hope so. Now I just can modify the authorize.conf for adding specific index name to a role, then restart splunk. It's a little unreasonable, but only solution from now.
Thank you again for notice this issue.

[Simeon]

Why do you have 100 indexes?