About cbowles

cbowles · ‎07-07-2015

This was exactly what I needed, thanks!

cbowles · ‎02-25-2015

This comment really saved me a lot of trouble, I can verify that these steps works.

cbowles · ‎08-02-2012

Lowell, this has been a while ago, but I have still not seen a good answer for this. Could you followup on this?

cbowles · ‎05-23-2012

Support Case # 84640 for this issue.

cbowles · ‎05-18-2012

Followup - Problem Resolved At it turns out, Splunk was working as advertised. The problem observed was the result of two different configurations interacting in an unexpected way. The user in question had been granted access to the index in question via a Splunk Group that had only granted access (but not set the index as a "default search") The group that was supposed to grant access and set the index as default was not being used since its corresponding Active Directory group was empty. Under the assumption that the specific group was working correctly, the only explanation was that there was a Splunk bug with how the SrchIndexesDefault variable was being combined for the user. Once I discovered that the user was being given access to the index through a group that did not set the SrchIndexesDefault variable, the pieces fell into place. I rectified the config and test, and Splunk worked correctly.

cbowles · ‎05-14-2012

YannK, I have verified that srchIndexesAllowed values are correctly being inherited, i.e. members of the foo and goo groups get the combination of the two: foo -->srchIndexesAllowed=foo goo --> srchIndexesAllowed=goo ending with the user getting --> srchIndexesAllowed=foo,goo However, the SrchIndexesDefault fields are not working in the same way. To use the example from above: foo -->srchIndexesAllowed=foo goo --> srchIndexesAllowed=goo ending with the user getting --> srchIndexesAllowed=goo Will file a support ticket.

cbowles · ‎05-10-2012

I've got a Splunk Installation with multiple independent Splunk Roles that grant access to individual indexes and also list that index as the default search index. My assumption was that the SrchIndexesDefault field would be OR'd between the various group memberships, similar to how the srchFilter works, so that the final default search indexes would be the combination of all of the individual groups. However, I have found that instead it is the final Splunk group that provides the SrchIndexesDefault value. I.e. if the user was a member of foo and goo , it would be the SrchIndexesDefault from goo that would apply to the user. Two questions: Am I missing something here, or is this implementation of SrchIndexesDefault working as designed? What is the recommended manner for granting access to multiple independent indexes? I am considering creating higher-level groups that inherit the values of the lower level groups, but I would prefer to preserve my building block approach if possible. Thanks! Chris Bowles

cbowles · ‎05-04-2012

ddeighton, I found the same exact issue on my Splunk Server. This seems to be a bug with Splunk where the Splunk Search Head only recognizes alert_actions.conf in the local (/opt/splunk/etc/system/local) config directory. Submitted a bug report.

Posts	8
Solutions	0
Karma Given	7
Karma Received	4
Member Since	‎04-22-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Users with multiple Splunk Roles

Re: Summary Stats for a Subsearch

Re: What do I do if rebuilding a bucket fails?

Re: summary index question

Re: alert_actions.conf being ignored

Re: Users with multiple Splunk Roles

Re: Users with multiple Splunk Roles

Users with multiple Splunk Roles

Re: alert_actions.conf being ignored