Created on 07-13-201808:10 AM - edited 09-16-202201:43 AM
Using Apache Solr as the indexing and search engine for Metron requires the Metron REST service to perform queries to multple collections. If the Ranger plugin is active there is currently a gotcha ( = Ranger Solr plugin bug). If you don't want to give the Metron user full access to all Solr collections here is a workaround.
2+ Solr collections that are being queried: metaalert, cef,.... (and other parser collections):