Splunk Search

Why is a power user unable to search a particular index?

shreyasathavale
Communicator

I have admin user and power user (role=power), when i search a particular index (iis_web) it does not return the output for power user but gives output for admin user. But for other indexes it returns the output. The server for iis_web is 2012 and others are 2008 . Is it related to OS or some other reason?

Tags (4)
0 Karma

cit_student
Explorer

Also, check your authorize.conf file, start with the one in SPLUNK_ROOT/etc/system/local
If this file has srchIndexesAllowed variable configured and your index isn't in that list, search will show zero results on that index, even though the front-end displays all Roles and Indexes as searchable in Settings.

0 Karma

Raghav2384
Motivator

Edit the power role and see if that index is searchable for users in that role. If it's not listed under "restrict this role to xyz index(s)", adding that particular index would allow searching.

Hope this helps!
Thanks,
Raghav

shreyasathavale
Communicator

Thanks for reply..but its not working.. "main" is already added

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...