topic Re: How do I set the default search index in Splunk Light? in Splunk Search

How do I set the default search index in Splunk Light?

jrailton — Tue, 29 Sep 2020 09:51:31 GMT

In Splunk Enterprise you can set the default search index per user. In Splunk Light you cannot it seems?

I read another post which said you can edit the \etc\system\default\indexes.conf file and set defaultDatabase=my_new_index

And yet another post that said you should create \etc\system\local\indexes.conf file and set defaultDatabase=my_new_index

I tried both and restarted Splunk after each, but neither have made a difference.

Re: How do I set the default search index in Splunk Light?

somesoni2 — Mon, 06 Jun 2016 16:22:27 GMT

The Splunk Light doesn't support role customization (the default searched index is role/user level attribute).

Also, you should never change any configuration from folder \etc\system\default\.

Re: How do I set the default search index in Splunk Light?

dkoshe_splunk — Tue, 07 Jun 2016 00:09:57 GMT

create new file \etc\system\local\authorize.conf and add following stanza, to make that index searchable by default for all users:

[role_user]
srchIndexesDefault = main;my_new_index

If you want to restrict it to only Administrators, then use following stanza instead:

[role_admin]
srchIndexesDefault = main;my_new_index

and then restart Splunk Light.
Changing indexes.conf, will only change your default index when importing data.
Also, @somesoni2 is correct, you should never update conf files under default, as they will get overwritten upon updates.
Hope this helps.

Re: How do I set the default search index in Splunk Light?

MuS — Tue, 07 Jun 2016 00:25:46 GMT

"all these worlds are yours, except /default - attempt no editing there"

-- @duckfez, 2010

http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Configurationfiledirectories