Splunk Search

Does splunk user should query data using Index value?

saifuddin9122
Path Finder

Hello All,

can users in splunk query data without using the index defined in search query? i mean can user search data using the sourcetype without defining the index in query? if so where should i define this property. As we have number of indexes defined and our users does not have idea of indexes, we don't want to query results using the index.

Thanks

0 Karma

klopez30
Explorer

I believe that just searching on source/sourcetype is fine, as long as the defaults are set correctly for your environment. I have worked in an environment where the index field was overloaded to search so that you could see similar data, but your defaults controlled what you saw just by searching on the source/sourcetype.

You have to make sure that the roles your splunk user inherits does not have indexes that are selected by default that you do not want to have your splunk user have access to by default.

0 Karma

teunlaan
Contributor

Yes you can (not recommended ) . You need to make all you indexes "searched by default"

Configure it in "Settings > Access Controls > Roles > the_role_your users_belong_too"" option : Indexes searched by default"

p_gurav
Champion

Hi saifuddin9122,

You can create macros for it.

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...