Appending to srchIndexesDefault / srchIndexesAllowed

Question

For a given role, is there a way to add extend the list of allowed/default indexes, without specifying the entire list?

I know that this can be overriden in an app, but specifying the entire list at the app level seems like asking for trouble - sooner or later two apps will conflict.

For example, given the default configuration:

[role_admin]
srchIndexesAllowed = *;_*
srchIndexesDefault = main;os

Is there a macro or variable substitution that would allow tacking on, similar to how one would append new directories to $PATH or %PATH% in the operating system? I'd like to be able to do something like:

[role_admin]
srchIndexesAllowed = $srchIndexesAllowed$;newindex
srchIndexesDefault = $srchIndexesDefault$;newindex

Accepted Answer

1

Roles can inherit other roles, so in this case it would make sense to have a role that inherits the base set of indexes. For example, you could have a role_base and a role_extra_stuff:

[role_base]
srchIndexesAllowed = main
srchIndexesDefault = main

[role_extra_stuff]
importRoles=role_base
srchIndexesAllowed = new_index
srchIndexesDefault = new_index

The final index capabilities would be role_base having the base set of indexes, and role_extra_stuff having both the base and specific indexes.

link

answered 03 Sep '10, 15:29

Simeon ♦
3.7k●5●6●28
accept rate: 26%

Does that mean that it is not possible to have a role inherit from [role_extra_stuff] and not have it be able to access new_index?

For example, what if there are settings in [role_extra_stuff] that would be also in [role_one_more]? Those settings would have to be copied into [role_one_more] directly rather than having a third level that inherits from [role_extra_stuff]. Is that right?

(03 Sep '10, 17:08) southeringtonp ♦

Appending to srchIndexesDefault / srchIndexesAllowed

Follow this question

Splunk Resources

Related questions