Default app vs role indexes

[aholzer]

I have begun an investigation into best practices for default index configuration.

So far I have found two options:

1. Setting the attribute "defaultDatabase" in the indexes.conf at the app level. See here: http://docs.splunk.com/Documentation/Splunk/5.0.4/Admin/indexesconf. This seems to be limited to a single index.
2. Using the default index feature of the role configurations. This way you can configure multiple indexes as the default index to search against.

Question:

How do the defaults at the App level vs the Role level interact?

When a user has multiple roles with differing default indexes, the user ends with a combination of all default indexes as their default indexes. Do these settings interact in a similarly cumulative behavior? Or does one take precedence over the other?

[aholzer · Accepted solution]

I just tested this myself, and I believe that the defaultDatabase in the indexes.conf is not doing what the spec says it does

The test:
I created a new app (test_app) indexes.conf defined as "defaultDatabase = myindex"

I created a new role (test_role) it has all the privileges that the default "user" role has, but no default index defined

I created a new user (test_user) which has the "test_role" set to it

I logged in as "test_user" navigated to "test_app", ran a blank search for the last 60m and received events from any index that had events, rather than only events from "myindex"

------------ Update ------------

This implies that the "defaultDatabase" doesn't affect the index that the Searches query inside an app. Therefore there is no interaction between the default indexes defined in the Role and the default database defined at the app level.

[yannK]

For default database and databases searches by default, if an user is member of several roles or inherit between multiple roles, the final result will be the sum of all the permissions.

• roleA : defaultDatabase=indexA
• roleB : defaultDatabase=indexB, indexC,_*
• user with roleA and role B will have: indexA,indexB, indexC,_*

For the default app, I have no idea, it may be alphabetical based on the role or on the app name...
to verify

[aholzer]

Yeah, I was aware of the cumulative nature of default indexes / databases between multiple roles, I was wondering if the app default is also cumulative with the role defaults.