How can I ignore internal splunk data when searching?

[joseph_hazlett]

Without having to add a filter every time I search, is it possible to ignore all the internal splunk data when running a basic search? For example, we wanted to know if a user has ever logged into one of the systems, so I just typed the username in the search box. The only results I received were from Splunk itself, and the data was a bunch of rows containing the web logs for the query I just submitted to the system. I don't care to see these results, ever, so I'd like to exclude them from future searches. I tried disabling the indexes, but since they are internal, it would not allow me to do that.

[martin_mueller · Accepted solution]

Make sure the role(s) for your user only search non-internal indexes by default.

[joseph_hazlett]

Thank you! I removed the internal indexes as the defaults for the admin user and it looks like it's working as expected.