topic Re: How to force my user to specify an index in Splunk Search

How to force my user to specify an index

llacoste — Wed, 02 Dec 2020 20:15:56 GMT

Hi,

So I've been facing some challenges with some of my users and I don't really know exactly how to tackle this.

Despite common sense and explaining them on a "welcoming page" on their app how to search with index="theirIndex" sourcetype="blabla" ...

They keep on not using index="", because you know, it works... they are searching all the indexes they've got access to with their roles and it's quite annoying when they should really specify an index there.

Do you have any advice on how to introduce that? I read about some filter that could be applied in the past with srchFilter or even thought of removing the Default indexes from their roles but not really sure which work best.

Thank you all, sorry if it's an easy question.

Ps: yes, my users are quite stubborn sometimes, I already won the "all time" challenge 😉

Re: How to force my user to specify an index

richgalloway — Wed, 02 Dec 2020 21:25:09 GMT

I recommend removing the default indexes from their roles. Once searches stop working they'll learn to use index=.

Re: How to force my user to specify an index

llacoste — Wed, 02 Dec 2020 21:32:54 GMT

Thought I would do that but I don't really know if that's the best "splunky" way of dealing with it as there is always 10 ways of doing things with Splunk ahah.

I'll try it thank you. I'm sure they'll love it 😄

Re: How to force my user to specify an index

richgalloway — Thu, 03 Dec 2020 13:43:34 GMT

That is the best way, IMO. Search filters may be able to accomplish the goal, but they tend to be easy to work around and a challenge to manage.

Workload Management's "Admission Rules" feature has the potential for doing this very well, but lacks the ability to test for the absence of something. You can block "index=*", for example, but can't determine if an index was not specified.