Splunk Search

[7.3] Index Selection for roles does not show all indexes

sylim_splunk
Splunk Employee
Splunk Employee

upgraded to 7.3 and they can no longer see all 208 indexes that we have when editing roles.
When you edit a role and try to add it as searchable it does not display them all and you can not search for them.

Tags (1)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

This has been fixed in the version 7.3.3+ which is already available for downloading.
You can also implement the workaround below until the upgrade;

** Workaround

  1. Open to edit $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/pages/enterprise/authorization_roles.js
  2. Find the line below; this.indexListSearchJob.getResults().subscribe(function(results)
  3. Add the following between the parentheses which will allow 1000 indexes to be displayed. { count: 1000 } Should be like this: this.indexListSearchJob.getResults({ count: 1000 }).subscribe(function(results)
  4. Save file and hit the _bump endpoint. Click the "Bump version" button to force browser caches to make the change take effect. http(s)://yourSplunk:8000/en-US/_bump We have planned to fix this permanantly by implementing pagination for the list instead of listing up all in one.

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

This has been fixed in the version 7.3.3+ which is already available for downloading.
You can also implement the workaround below until the upgrade;

** Workaround

  1. Open to edit $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/build/pages/enterprise/authorization_roles.js
  2. Find the line below; this.indexListSearchJob.getResults().subscribe(function(results)
  3. Add the following between the parentheses which will allow 1000 indexes to be displayed. { count: 1000 } Should be like this: this.indexListSearchJob.getResults({ count: 1000 }).subscribe(function(results)
  4. Save file and hit the _bump endpoint. Click the "Bump version" button to force browser caches to make the change take effect. http(s)://yourSplunk:8000/en-US/_bump We have planned to fix this permanantly by implementing pagination for the list instead of listing up all in one.

gjanders
SplunkTrust
SplunkTrust

@sylim_splunk the release notes of 7.3.3 "Index Selection for roles only shows 100 indexes", is it fixed in that version?

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

Thank you for the info,I'm checking. I'll update here once confirmed.

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

Just fixed the version, thanks @gjanders for pointing that out.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...