Splunk Enterprise

Health Check: The list of indexes to be searched by default by the admin role on Splunk server

zekiramhi
Path Finder

The Full error is as follows:

Health Check: The list of indexes to be searched by default by the admin role on Splunk server "xxx" includes all non-internal indexes which might cause performance problems

Is there a way to check which alert, dashboard or report is causing the issue ?

I know the specific time that this notification triggers but I do not know how much of use that would be.

I have went through this article, but it doesnt really answer my question but only to shut off the alerts: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Troubleshootdefaultadminsearches

Best Regards,

Labels (3)
0 Karma

inventsekar
Ultra Champion

Hi @zekiramhi  

(edited)

Disable the search to prevent messages

If you do not want to limit the indexes searched by the admin role, but you want to stop seeing messages, disable the search.

  1. Select Settings > Searches, reports, and alerts.
  2. Locate the Audit - Default Admin Search All Non-Internal search.
  3. Select Edit > Disable.
  4. Click Disable.

https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Troubleshootdefaultadminsearches

 

0 Karma

zekiramhi
Path Finder

Hello,

I do not want to disable the messages caused by the specific alert you have mentionned, but rather find the specific search, alert or dashboard that is causing said message to popup every now and then.

Hopefully I made myself clear 😁

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...