Why is a power user unable to search a particular index?

[shreyasathavale]

I have admin user and power user (role=power), when i search a particular index (iis_web) it does not return the output for power user but gives output for admin user. But for other indexes it returns the output. The server for iis_web is 2012 and others are 2008 . Is it related to OS or some other reason?

[cit_student]

Also, check your authorize.conf file, start with the one in SPLUNK_ROOT/etc/system/local
If this file has srchIndexesAllowed variable configured and your index isn't in that list, search will show zero results on that index, even though the front-end displays all Roles and Indexes as searchable in Settings.

[Raghav2384]

Edit the power role and see if that index is searchable for users in that role. If it's not listed under "restrict this role to xyz index(s)", adding that particular index would allow searching.

Hope this helps!
Thanks,
Raghav

[shreyasathavale]

Thanks for reply..but its not working.. "main" is already added