User Roles

[Dolly]

Hello everyone, I am facing an issue related to a Splunk user role. A role was created with access to indexes 1, 2, 3, and 4, and all members assigned to this role were able to access those indexes successfully. Later, access to another index (index 5) was added to the same role. However, the users assigned to the role are still unable to access index 5. Has anyone encountered a similar issue or knows if there are additional steps required for the updated index permissions to take effect?

[PickleRick]

Assuming the users logged out and back in (just to be sure; I'm not 100% it's required), editing roles should be quite immediate.

Question is how how did you edit those permissions? Maybe you did edit the authorize.conf file and did _not_ reload the effective config?

[Dolly]

The permissions were given on UI. Yes, its immediate but for this particular case, its not working.

[isoutamo]

You could try this to check how splunk see those roles and if there is some other roles inherited to your role or users.

https://community.splunk.com/t5/Splunk-Search/How-to-Generate-Roles-to-Indexes-table/m-p/654874/high...

[livehybrid]

Hi @Dolly 

If the change to the role has been made on the SH then it should apply instantly. Can you confirm that there is data being received into the index (5) ? 

Are there any other limits on the role which might impact such as search filters?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Dolly]

Yes there is data in index 5. No other limits on role