Does splunk user should query data using Index value?

[saifuddin9122]

Hello All,

can users in splunk query data without using the index defined in search query? i mean can user search data using the sourcetype without defining the index in query? if so where should i define this property. As we have number of indexes defined and our users does not have idea of indexes, we don't want to query results using the index.

Thanks

[klopez30]

I believe that just searching on source/sourcetype is fine, as long as the defaults are set correctly for your environment. I have worked in an environment where the index field was overloaded to search so that you could see similar data, but your defaults controlled what you saw just by searching on the source/sourcetype.

You have to make sure that the roles your splunk user inherits does not have indexes that are selected by default that you do not want to have your splunk user have access to by default.

[teunlaan]

Yes you can (not recommended ) . You need to make all you indexes "searched by default"

Configure it in "Settings > Access Controls > Roles > the_role_your users_belong_too"" option : Indexes searched by default"

[p_gurav]

Hi saifuddin9122,

You can create macros for it.