Health Check: The list of indexes to be searched by default by the admin role on Splunk server

[zekiramhi]

The Full error is as follows:

Health Check: The list of indexes to be searched by default by the admin role on Splunk server "xxx" includes all non-internal indexes which might cause performance problems

Is there a way to check which alert, dashboard or report is causing the issue ?

I know the specific time that this notification triggers but I do not know how much of use that would be.

I have went through this article, but it doesnt really answer my question but only to shut off the alerts: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Troubleshootdefaultadminsearches

Best Regards,

[inventsekar]

Hi @zekiramhi  

(edited)

Disable the search to prevent messages

If you do not want to limit the indexes searched by the admin role, but you want to stop seeing messages, disable the search.

1. Select Settings > Searches, reports, and alerts.
2. Locate the Audit - Default Admin Search All Non-Internal search.
3. Select Edit > Disable.
4. Click Disable.

https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Troubleshootdefaultadminsearches

[zekiramhi]

Hello,

I do not want to disable the messages caused by the specific alert you have mentionned, but rather find the specific search, alert or dashboard that is causing said message to popup every now and then.

Hopefully I made myself clear 😁