topic Re: Add index to default searched index in splunk light. in Getting Data In

Add index to default searched index in splunk light.

matt_squaretrad — Thu, 24 Mar 2016 20:33:45 GMT

I'm forwarding traffic from a window file server to a splunk light instance. The index where the data is received is wineventlog. That index isn't searchable. How do I add that index to the default indexes being searched? The windows server uses the universal forwarder.

Information I'm seeing on this topic seems to references making role changes, but this isn't showing as an option in Splunk light 6.3.3

Re: Add index to default searched index in splunk light.

jterry — Mon, 04 Apr 2016 23:54:05 GMT

not searchable? have you tried "index=wineventlog *"

Re: Add index to default searched index in splunk light.

jterry — Tue, 12 Apr 2016 17:40:07 GMT

not searchable? have you tried "index=wineventlog *"

Re: Add index to default searched index in splunk light.

mkallies — Thu, 26 May 2016 12:20:08 GMT

I was able to get this working on Splunk Light with the following in /opt/splunk/etc/system/local/authorize.conf

[default]
[role_user]
srchIndexesAllowed = *
srchIndexesDefault = main;wineventlog

[role_admin]
srchIndexesAllowed = *;_*
srchIndexesDefault = main;os;wineventlog

The Splunk Enterprise parameters seem to work ok here:

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/Addandeditroleswithauthorizeconf

I copied and edited the parameters from etc/system/default/authorize.conf