- Splunk Answers
- :
- Splunk Administration
- :
- Security
- :
- What is causing an incomplete index list for role ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
We recently upgraded to Splunk Enterprise vesion 7.3.1.1 and we're trying to add new roles to the instance. However, we noticed that on the index restriction section that not every index is being listed. It seems to only list the first 100 indexes.
Is this a bug for 7.3.1.1? Is there a workaround available for it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just an update, we were able to open a case for it and below were the given steps for a workaround:
Please follow the workaround steps to fix the issue.
A. on every affected SH edit
Go to the next path
/opt/splunk/share/splunk/search_mrsparkle/exposed/build/pages/enterprise/
Look the file: authorization_roles.js
B. Then find the following information.
this.indexListSearchJob.getResults().subscribe((results)
C. Add the following between the parentheses.
{ count: 1000 }
so that it looks like this:
this.indexListSearchJob.getResults({ count: 1000 }).subscribe((results)
D. Save file and hit the _bump endpoint:
https://<yourSplunk>/en-US/_bump on this point will depend if you are using secure UI add the s and if not you can log into like this
http://<yourSplunk>/en-US/_bump
However, I couldn’t find the string stated in bullet point B [this.indexListSearchJob.getResults().subscribe((results)] but I did find a similar string which says “this.indexListSearchJob.getResults().subscribe(function(results)” and that’s where I applied the workaround. Also, I tried opening the file with a text editor and saving it leading to a bunch of invalid characters to show up. I instead used the sed command to replace the text.
Hope this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just an update, we were able to open a case for it and below were the given steps for a workaround:
Please follow the workaround steps to fix the issue.
A. on every affected SH edit
Go to the next path
/opt/splunk/share/splunk/search_mrsparkle/exposed/build/pages/enterprise/
Look the file: authorization_roles.js
B. Then find the following information.
this.indexListSearchJob.getResults().subscribe((results)
C. Add the following between the parentheses.
{ count: 1000 }
so that it looks like this:
this.indexListSearchJob.getResults({ count: 1000 }).subscribe((results)
D. Save file and hit the _bump endpoint:
https://<yourSplunk>/en-US/_bump on this point will depend if you are using secure UI add the s and if not you can log into like this
http://<yourSplunk>/en-US/_bump
However, I couldn’t find the string stated in bullet point B [this.indexListSearchJob.getResults().subscribe((results)] but I did find a similar string which says “this.indexListSearchJob.getResults().subscribe(function(results)” and that’s where I applied the workaround. Also, I tried opening the file with a text editor and saving it leading to a bunch of invalid characters to show up. I instead used the sed command to replace the text.
Hope this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That workaround does work. We tested it out this morning and will be putting it in place until we upgrade. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We opened a support case with Splunk for this issue. Apparently it is a known issue tracked with "SPL-172789 - Index Selection for roles only shows 100 indexes" and has been marked as fixed in 7.3.3. We will be upgrading to that version to correct this issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Still seems to be here in 7.3.2. Have you opened a support case by chance?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just posted the workaround. Sorry it took a while.
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
