Splunk Search

[7.3] Index Selection for roles does not show all indexes

sylim_splunk
Splunk Employee
Splunk Employee

upgraded to 7.3 and they can no longer see all 208 indexes that we have when editing roles.
When you edit a role and try to add it as searchable it does not display them all and you can not search for them.

Tags (1)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

This has been fixed in the version 7.3.3+ which is already available for downloading.
You can also implement the workaround below until the upgrade;

** Workaround

  1. Open to edit $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/pages/enterprise/authorization_roles.js
  2. Find the line below; this.indexListSearchJob.getResults().subscribe(function(results)
  3. Add the following between the parentheses which will allow 1000 indexes to be displayed. { count: 1000 } Should be like this: this.indexListSearchJob.getResults({ count: 1000 }).subscribe(function(results)
  4. Save file and hit the _bump endpoint. Click the "Bump version" button to force browser caches to make the change take effect. http(s)://yourSplunk:8000/en-US/_bump We have planned to fix this permanantly by implementing pagination for the list instead of listing up all in one.

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

This has been fixed in the version 7.3.3+ which is already available for downloading.
You can also implement the workaround below until the upgrade;

** Workaround

  1. Open to edit $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/pages/enterprise/authorization_roles.js
  2. Find the line below; this.indexListSearchJob.getResults().subscribe(function(results)
  3. Add the following between the parentheses which will allow 1000 indexes to be displayed. { count: 1000 } Should be like this: this.indexListSearchJob.getResults({ count: 1000 }).subscribe(function(results)
  4. Save file and hit the _bump endpoint. Click the "Bump version" button to force browser caches to make the change take effect. http(s)://yourSplunk:8000/en-US/_bump We have planned to fix this permanantly by implementing pagination for the list instead of listing up all in one.

gjanders
SplunkTrust
SplunkTrust

@sylim_splunk the release notes of 7.3.3 "Index Selection for roles only shows 100 indexes", is it fixed in that version?

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

Thank you for the info,I'm checking. I'll update here once confirmed.

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

Just fixed the version, thanks @gjanders for pointing that out.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...