https://community.splunk.com/t5/Splunk-Search/Schedule-search-includes-result-from-non-default-index/m-p/353903#M161223 <P>From the document, if index=myindex was not mentioned, Splunk search will only use default indexes. However, I found that the behaviour is not true anymore. When I run a search, result return from non default index as well.</P> <P>What is the possible cause? </P> Fri, 28 Apr 2017 09:30:30 GMT daniel_splunk 2017-04-28T09:30:30Z https://community.splunk.com/t5/Splunk-Search/Schedule-search-includes-result-from-non-default-index/m-p/353903#M161223 <P>From the document, if index=myindex was not mentioned, Splunk search will only use default indexes. However, I found that the behaviour is not true anymore. When I run a search, result return from non default index as well.</P> <P>What is the possible cause? </P> Fri, 28 Apr 2017 09:30:30 GMT https://community.splunk.com/t5/Splunk-Search/Schedule-search-includes-result-from-non-default-index/m-p/353903#M161223 daniel_splunk 2017-04-28T09:30:30Z https://community.splunk.com/t5/Splunk-Search/Schedule-search-includes-result-from-non-default-index/m-p/353904#M161224 <P>You can check whether srchFilter is set in your role.</P> <P>For example, </P> <PRE><CODE>authorize.conf [default] srchFilter = NOT index=*_archive </CODE></PRE> <P>If you have set srchFilter to some value, it will get added to every search for this role.</P> <P>As your srchFilter exist, it includes an “index=“ line and Splunk is not going to look at the srchIndexesDefault parameter. </P> Fri, 28 Apr 2017 09:37:08 GMT https://community.splunk.com/t5/Splunk-Search/Schedule-search-includes-result-from-non-default-index/m-p/353904#M161224 daniel_splunk 2017-04-28T09:37:08Z