Security

indexes not visible when splunk has more than 100 indexes when assign them to a role on a slunk searchheader

Anthony_Hou
Path Finder

Dear sir,

indexes not visible when splunk has more than 100 indexes when assign them to a role on a slunk searchheader.

Issue happans on Distributed splunk structure and also standalone splunk structure.

we have a splunk search header can distrubte search for 5 splunk indexers.

When create or modify a role, the list of available indexes can not show all of indexes, when total number of indexes are more than 100.

We have a lab for standalone splunk, creating 120 indexes, every index's name are following the order from 1 to 120.
then we just can see about no. 80 indexes in the available list.

We have count the list of available indexes, we found it's only about 100 indexes and nothing more!

Is this a bug ?

Thanks for anyone have the answer.

tks,
Anthony Hou

Tags (2)
1 Solution

Simeon
Splunk Employee
Splunk Employee

There may be a limitation in the UI for the visible indexes available. There WAS a bug in older versions, where the length of parameters in authorize.conf would cause problems (not be applied). I recommend you log a case with support and check your version release notes.

View solution in original post

Simeon
Splunk Employee
Splunk Employee

There may be a limitation in the UI for the visible indexes available. There WAS a bug in older versions, where the length of parameters in authorize.conf would cause problems (not be applied). I recommend you log a case with support and check your version release notes.

Anthony_Hou
Path Finder

Dear Simeon,
thank you for the reply.
issue still on 4.2.5 splunk
The splunk support in our area has replied this morning. They said this is the limitation of the design. It seems not easy to have a hotfix for this issue, but they will try, I hope so. Now I just can modify the authorize.conf for adding specific index name to a role, then restart splunk. It's a little unreasonable, but only solution from now.
Thank you again for notice this issue.

0 Karma

Simeon
Splunk Employee
Splunk Employee

Why do you have 100 indexes?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...