User can see data in one index but not another with the same config

[krisreeves]

I've recently added some configuration that creates indexes for data. Each index has a corresponding role that adds both access to and search-by-default for the defined index. Let's suppose one index is called 'testing' and the other is called 'weblogs'.

Users in the 'testing' role can see data in the 'testing' index, and users in the 'weblogs' role can see data in the 'weblogs' index. However, a user in only the admin role, for which the allowed indexes are "all non-internal indexes", can see data in 'testing' but NOT in 'weblogs'.

The config files are generated from the same template, and btool on search heads and indexers shows that they are the same except for the index/role name.

I've yet to have any luck searching up a reason why this is the case. I'm okay with either outcome, but I don't understand why one index is behaving one way, and the other is behaving differently. How can I tell what's causing the difference?

[krisreeves · Accepted solution]

I'm not sure what was going on here, but the data seems visible to me now. Something of a glitch in the matrix, I guess...

[DalJeanis]

These are on different search heads? Verify that the admin role is set up correctly on the one where it cannot see the index. Admin should be able to see all indexes, and by the way, you should NOT be okay with any other result.

[krisreeves]

These are on the same search head.

I am okay with the other result in that, these indexes should be access-restricted and I'd prefer if that access was not present on admins by default (but expect that to implement that, I'd need to remove the * for the default searchable indexes - so the expected behavior here is I can see all the data)