https://community.splunk.com/t5/Getting-Data-In/block-queries-without-sourcetype/m-p/676841#M113194 <P>Hi</P><P>probably you could try Splunk Workload management for it. At least it works if users try to run queries without index=xyz. See more&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Workloads/WorkloadRules" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Workloads/WorkloadRules</A></P><P>r. Ismo</P> Wed, 07 Feb 2024 13:03:31 GMT isoutamo 2024-02-07T13:03:31Z https://community.splunk.com/t5/Getting-Data-In/block-queries-without-sourcetype/m-p/676835#M113193 <P>Is there any efficient way to block queries without the sourcetype? Educating users is not working and we wanted to block it so that there is no degradation of the environment</P> Wed, 07 Feb 2024 12:25:44 GMT https://community.splunk.com/t5/Getting-Data-In/block-queries-without-sourcetype/m-p/676835#M113193 bmcaetano 2024-02-07T12:25:44Z https://community.splunk.com/t5/Getting-Data-In/block-queries-without-sourcetype/m-p/676841#M113194 <P>Hi</P><P>probably you could try Splunk Workload management for it. At least it works if users try to run queries without index=xyz. See more&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Workloads/WorkloadRules" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Workloads/WorkloadRules</A></P><P>r. Ismo</P> Wed, 07 Feb 2024 13:03:31 GMT https://community.splunk.com/t5/Getting-Data-In/block-queries-without-sourcetype/m-p/676841#M113194 isoutamo 2024-02-07T13:03:31Z