topic How can I ignore internal splunk data when searching? in Getting Data In

How can I ignore internal splunk data when searching?

joseph_hazlett — Thu, 18 Dec 2014 17:28:00 GMT

Without having to add a filter every time I search, is it possible to ignore all the internal splunk data when running a basic search? For example, we wanted to know if a user has ever logged into one of the systems, so I just typed the username in the search box. The only results I received were from Splunk itself, and the data was a bunch of rows containing the web logs for the query I just submitted to the system. I don't care to see these results, ever, so I'd like to exclude them from future searches. I tried disabling the indexes, but since they are internal, it would not allow me to do that.

Re: How can I ignore internal splunk data when searching?

martin_mueller — Thu, 18 Dec 2014 17:41:49 GMT

Make sure the role(s) for your user only search non-internal indexes by default.

Re: How can I ignore internal splunk data when searching?

joseph_hazlett — Thu, 18 Dec 2014 20:47:27 GMT

Thank you! I removed the internal indexes as the defaults for the admin user and it looks like it's working as expected.