topic Re: Default indexes in Splunk free? in Installation

Default indexes in Splunk free?

jamesez — Wed, 02 Sep 2020 17:25:42 GMT

I am running Splunk 4.1.7 in the free license mode.

I added an index "noise" and created a transform that moves some events to it (e.g., ssh attempts).

Any * search is grabbing entries out of "main" and "noise," which does not agree with the manual and other information provided here. I have verified the transforms do work, as they show up "index=noise" when that is added to the results view.

Is setting default indexes for searching limited to the enterprise license?

Re: Default indexes in Splunk free?

jrodman — Thu, 24 Feb 2011 05:12:43 GMT

Sure enough, the default index set is '*' in Splunk Free.

void UserManagerFree::getDefaultIndexes(std::set<Str> &indexes)
{
    indexes.clear();

    // Use all public indexes
    AuthorizationManagerSplunk::addMatchingIndexes("*", indexes);
}

This seems consistent with http://www.splunk.com/view/how-to-get-splunk/SP-CAAADFV which indicates that Free does not offer role based access controls. Essentially, all indexes are searched, unless manually specified.

However, we should possibly expand the section http://www.splunk.com/base/Documentation/latest/Installation/MoreAboutSplunkWithAFreeLicense since the default is definitely different in this case.

Re: Default indexes in Splunk free?

jamesez — Fri, 25 Feb 2011 23:45:10 GMT

I'd prefer it if the way it was described originally is how it was implemented, and not *.

Re: Default indexes in Splunk free?

jrodman — Wed, 02 Mar 2011 02:29:43 GMT

I'm not sure how it was described originally. In 3.x, we could only search one index at a time, so there was a single default. Maybe you found text from that timeframe? In early 3.x, custom indexes were not supported in Splunk Free at all, so that informed the historical choice. In any event, perhaps you could spell out how you feel it should work and why in an enhancement request? Those requests are helpful to us! These are currently submitted by the spunk support portal.