Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Security
- :
- on a searchhead users with new roles can not see d...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I encountered a strange problem, starting from few days ago, newly created roles on the searchhead are unable to access indexes on the indexer only the local are visible. Roles created earlier are working as expected.
In the logs I could not find any hint on the source of the problem.
How could I find the source of this problem?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What method are you using to distribute the knowledge bundle to your indexer ?
For example, if you are using mounted knowledge bundles you will need to copy the etc/system/local/authorize.conf file to your knowledge bundle mount for your indexer to pick up.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What method are you using to distribute the knowledge bundle to your indexer ?
For example, if you are using mounted knowledge bundles you will need to copy the etc/system/local/authorize.conf file to your knowledge bundle mount for your indexer to pick up.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for the clue, after the update to 4.2.4 the bundles on the indexer stopped being refreshed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not using mounted knowledge bundle, I assume that knowledge bundle is sent on every distributed search query.
Could it be that my knowledge bundle is to large? Are there limitations on that?
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
