How do I set the default search index in Splunk Light?

[jrailton]

In Splunk Enterprise you can set the default search index per user. In Splunk Light you cannot it seems?

I read another post which said you can edit the \etc\system\default\indexes.conf file and set defaultDatabase=my_new_index

And yet another post that said you should create \etc\system\local\indexes.conf file and set defaultDatabase=my_new_index

I tried both and restarted Splunk after each, but neither have made a difference.

[dkoshe_splunk · Accepted solution]

create new file \etc\system\local\authorize.conf and add following stanza, to make that index searchable by default for all users:

[role_user]
srchIndexesDefault = main;my_new_index

If you want to restrict it to only Administrators, then use following stanza instead:

[role_admin]
srchIndexesDefault = main;my_new_index

and then restart Splunk Light.
Changing indexes.conf, will only change your default index when importing data.
Also, @somesoni2 is correct, you should never update conf files under default, as they will get overwritten upon updates.
Hope this helps.

[somesoni2]

The Splunk Light doesn't support role customization (the default searched index is role/user level attribute).

Also, you should never change any configuration from folder \etc\system\default\.

[MuS]

"all these worlds are yours, except /default - attempt no editing there"

-- @duckfez, 2010

http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Configurationfiledirectories