topic Search without index not working in Splunk Search

Search without index not working

aupadhya — Fri, 11 Jan 2013 18:32:06 GMT

I installed latest Splunk and added splunkforwarder to index log data. Everything looks fine except that search doesn't return any data without specifying the index name, i.e

sourcetype="jetty"

doesn't work

but

index="app" sourcetype="jetty"

works

Any reason why search doesn't work without the index in the search query?

Re: Search without index not working

Ayn — Fri, 11 Jan 2013 18:58:21 GMT

By default only the main index is searched. You can change which indexes are searched by default for a user and/or role in the manager in the web interface, Manager -> Access Controls.

Re: Search without index not working

aupadhya — Fri, 11 Jan 2013 19:35:12 GMT

Thanks a lot

Re: Search without index not working

the_wolverine — Fri, 11 Jan 2013 22:28:18 GMT

Assuming the data exists, this behavior is dependent on the default settings for the role. If you want the "app" index to be searchable by default, just add that index to "Indexes searched by default" for the role in question.

Re: Search without index not working

rishrai — Wed, 25 Jan 2017 16:29:07 GMT

set default in access control as: index!=_*