topic Re: block any search for index=* with workload in Getting Data In

block any search for index=* with workload

bmcaetano — Mon, 22 Jan 2024 14:05:37 GMT

I'm trying to create an admission rule in workload management with the following syntax:

any search with "=*" in the index will return a predefined message.

my intention is to block any search that contains "=*" in any part of the index, such as: "index=splun*", "index=spl*", "index=_internal*", etc.

I didn't find anything in the documentation that talked about it. Is there any way to create a general rule for this case?

Re: block any search for index=* with workload

richgalloway — Mon, 22 Jan 2024 14:42:44 GMT

That use case is not supported by WLM admission rules. Go to https://ideas.splunk.com to make a case for it.

Re: block any search for index=* with workload

chrisboy68 — Tue, 03 Dec 2024 14:52:06 GMT

Reading through the Ideas, there are a few written different ways that will yield the same result. This is the simplest explanation, https://ideas.splunk.com/ideas/PLECID-I-606. If we can use * as a literal, then it will help your problem too. What would be best is to be able to implement a regex statement. At my shop, it would be ok to do index=ABCDE*, but not index=A*.