topic Re: Search query requirements in Splunk Search

Search query requirements

bleung93 — Fri, 18 Apr 2014 18:49:17 GMT

Is it possible to require fields in a search query for specific users/roles?

Non-power users or admins, they must have the search field index= sourcetype= source=

What would you have to do? Edit somewhere in the search app?

Re: Search query requirements

martin_mueller — Fri, 18 Apr 2014 21:22:27 GMT

What are you trying to achieve?

Re: Search query requirements

bleung93 — Fri, 18 Apr 2014 23:23:07 GMT

Situation: You are in a company that uses Splunk. Most of the users there are inexperienced with Search & Reporting.

Goal: You want to keep indexers from over allocating the resources to execute searches that are not properly created. (e.g. error OR warn "System Failure")

Re: Search query requirements

martin_mueller — Fri, 18 Apr 2014 23:29:57 GMT

Ah, I see. I don't think there's a way to force people into specifying a source or sourcetype, but you can force lower roles to specify indexes by removing their searched-by-default indexes. Keep in mind though, they can just specify index=* and you're back to square one.
Another way to reduce inadvertent load is to reduce the time range searchable by lower roles to a week, a month, or whatever makes sense in your roles' scenarios. Another caveat here, make sure you're not killing the usability of Splunk for them by restricting the range too much.
Consider giving them smart accelerated data models so they use the Pivot interface instead of building reports manually.
Depending on the scenario, build custom forms for certain tasks that hide the search language a bit.

However, the best thing to do is user education. Your server load will drop, and users' productivity will go up - win win.

Re: Search query requirements

bleung93 — Mon, 21 Apr 2014 22:33:41 GMT

You are right about educating users. Currently not using Splunk 6 to use the Pivot feature yet though.