Splunk 6 change in index searching

[richgalloway]

On our Splunk 5 system I can search for a sourcetype and it will be found in any non-internal index. For example, searching for 'sourcetype=foo' will find matching events in the default index as well as in index 'bar'.

On our Splunk 6 system, however, the same search returns no results if the event is not in the default index. I have to specify the index to find events not in the default index ('sourcetype=foo index=bar', for example).

Is this change in behavior intentional? I haven't seen mention of it in the release notes.

[sowings · Accepted solution]

That change is nothing to do with Splunk 6. In fact, the behavior you describe is "out of the box" behavior for Splunk 5 as well. Your Splunk 5 installation has configured your user role (or perhaps your user, specifically) for "indexes searched by default" to be "all non-internal indexes". You could make the same change to roles on 6 to restore the behavior.