Default indexes in Splunk free?

[jamesez]

I am running Splunk 4.1.7 in the free license mode.

I added an index "noise" and created a transform that moves some events to it (e.g., ssh attempts).

Any * search is grabbing entries out of "main" and "noise," which does not agree with the manual and other information provided here. I have verified the transforms do work, as they show up "index=noise" when that is added to the results view.

Is setting default indexes for searching limited to the enterprise license?

[jrodman · Accepted solution]

Sure enough, the default index set is '*' in Splunk Free.

void UserManagerFree::getDefaultIndexes(std::set<Str> &indexes)
{
    indexes.clear();

    // Use all public indexes
    AuthorizationManagerSplunk::addMatchingIndexes("*", indexes);
}

This seems consistent with http://www.splunk.com/view/how-to-get-splunk/SP-CAAADFV which indicates that Free does not offer role based access controls. Essentially, all indexes are searched, unless manually specified.

However, we should possibly expand the section http://www.splunk.com/base/Documentation/latest/Installation/MoreAboutSplunkWithAFreeLicense since the default is definitely different in this case.

[jrodman]

I'm not sure how it was described originally. In 3.x, we could only search one index at a time, so there was a single default. Maybe you found text from that timeframe? In early 3.x, custom indexes were not supported in Splunk Free at all, so that informed the historical choice. In any event, perhaps you could spell out how you feel it should work and why in an enhancement request? Those requests are helpful to us! These are currently submitted by the spunk support portal.

[jamesez]

I'd prefer it if the way it was described originally is how it was implemented, and not *.