Splunk Search

Why is index missing in list of indexes while editing roles?

pharmapartners
Explorer

We are running splunk 9.0.5

We want to add an index to the default indexes for a user role, but the index does not show up in the list of indexes in the "Edit User Role" window, tab "Indexes" on the search head

There is data in the index and we do see the index in the monitoring console under Indexing / Index Detail:Deployment

We did also add the following to the /opt/splunk/etc/system/local/server.conf on the search head :
[introspection:distributed-indexes]
disabled = false
(And restarted the splunk service on the search head afterwards)

The index was created earlier (before 9.0.5) via the master node file /opt/splunk/etc/master-apps/_cluster/local/indexes.conf (now moved to manager_apps)
A push of the bundle did not make any changes (peers already had the correct version)

What else could be the issue here ?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is why it's important to push indexes.conf to search heads as well as to indexers.  Of course, the Cluster Manager (CM) will not do that so it's up to you (or your Splunk Admin) to copy indexes.conf to the SHs either manually or via the SHC Deployer.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This is why it's important to push indexes.conf to search heads as well as to indexers.  Of course, the Cluster Manager (CM) will not do that so it's up to you (or your Splunk Admin) to copy indexes.conf to the SHs either manually or via the SHC Deployer.

---
If this reply helps you, Karma would be appreciated.

pharmapartners
Explorer

That did the trick indeed. Thanks a lot.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...