Archive
Highlighted

Splunk 6 change in index searching

SplunkTrust
SplunkTrust

On our Splunk 5 system I can search for a sourcetype and it will be found in any non-internal index. For example, searching for 'sourcetype=foo' will find matching events in the default index as well as in index 'bar'.

On our Splunk 6 system, however, the same search returns no results if the event is not in the default index. I have to specify the index to find events not in the default index ('sourcetype=foo index=bar', for example).

Is this change in behavior intentional? I haven't seen mention of it in the release notes.

---
If this reply helps you, an upvote would be appreciated.
Tags (3)
0 Karma
Highlighted

Re: Splunk 6 change in index searching

Splunk Employee
Splunk Employee

That change is nothing to do with Splunk 6. In fact, the behavior you describe is "out of the box" behavior for Splunk 5 as well. Your Splunk 5 installation has configured your user role (or perhaps your user, specifically) for "indexes searched by default" to be "all non-internal indexes". You could make the same change to roles on 6 to restore the behavior.

View solution in original post