Splunk Search

[7.3] Index Selection for roles does not show all indexes

sylim_splunk
Splunk Employee
Splunk Employee

upgraded to 7.3 and they can no longer see all 208 indexes that we have when editing roles.
When you edit a role and try to add it as searchable it does not display them all and you can not search for them.

Tags (1)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

This has been fixed in the version 7.3.3+ which is already available for downloading.
You can also implement the workaround below until the upgrade;

** Workaround

  1. Open to edit $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/pages/enterprise/authorization_roles.js
  2. Find the line below; this.indexListSearchJob.getResults().subscribe(function(results)
  3. Add the following between the parentheses which will allow 1000 indexes to be displayed. { count: 1000 } Should be like this: this.indexListSearchJob.getResults({ count: 1000 }).subscribe(function(results)
  4. Save file and hit the _bump endpoint. Click the "Bump version" button to force browser caches to make the change take effect. http(s)://yourSplunk:8000/en-US/_bump We have planned to fix this permanantly by implementing pagination for the list instead of listing up all in one.

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

This has been fixed in the version 7.3.3+ which is already available for downloading.
You can also implement the workaround below until the upgrade;

** Workaround

  1. Open to edit $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/pages/enterprise/authorization_roles.js
  2. Find the line below; this.indexListSearchJob.getResults().subscribe(function(results)
  3. Add the following between the parentheses which will allow 1000 indexes to be displayed. { count: 1000 } Should be like this: this.indexListSearchJob.getResults({ count: 1000 }).subscribe(function(results)
  4. Save file and hit the _bump endpoint. Click the "Bump version" button to force browser caches to make the change take effect. http(s)://yourSplunk:8000/en-US/_bump We have planned to fix this permanantly by implementing pagination for the list instead of listing up all in one.

gjanders
SplunkTrust
SplunkTrust

@sylim_splunk the release notes of 7.3.3 "Index Selection for roles only shows 100 indexes", is it fixed in that version?

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

Thank you for the info,I'm checking. I'll update here once confirmed.

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

Just fixed the version, thanks @gjanders for pointing that out.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...