Unable to create or edit indexes in Splunk Cloud UI due to permission error.

Applicability

Description

In the Splunk Web interface, when navigating to Settings > Indexes  in Splunk Cloud Platform, the options to create a new index or edit the searchable storage of existing indexes are unavailable or non-functional. This behavior persists even when the user is assigned the admin or sc_admin roles.

The "Create Index" button is disabled, and the following warning may appear in the UI:

You do not have permission to create a new index.

The issue is typically caused by the getIndexesListWithFederated saved search being in 10.x versions set to a disabled state. This is a default saved search of the Cloud Administration application required to populate and manage the index list in 10.x and similarly the getIndexesList savedsearch is present in 9.x versions which should always be enabled.

Investigation

1. Check the status  getIndexesListWithFederated and getIndexesList by navigating to settings > Searches, Reports, and Alerts and search for these searches.
   
   
2. Note that these are default saved searches of the Cloud Administration application required to populate and manage the index list which should always be enabled.
   
   
3. When a custom application is installed with the savedsearch.conf  [default] stanza having disabled=1, it will by default disable all the savedsearches which don't have disabled=0  explicitly set.  Hence check for any default settings in custom application having disabled=1 or any default settings.

Resolution

1. Enable these required searches manually on the UI, by navigating to settings >  Searches, Reports, and Alerts and search for getIndexesListWithFederated and getIndexesList and changing the status to Enabled from disabled.
   
   
2. If unable to change the status, then raise a Splunk cloud support case to troubleshoot further.
   
   
3. Kindly review every custom applications before installing in Splunk Cloud to check if there's any default settings set to 1 or disabled so that it doesn't cause other setting/ searches to be disabled which doesn't have  disabled=0  explicitly set as it is not recomended to disable any settings in [default] stanza.