How to force my user to specify an index

[llacoste]

Hi,

So I've been facing some challenges with some of my users and I don't really know exactly how to tackle this.

Despite common sense and explaining them on a "welcoming page" on their app how to search with index="theirIndex" sourcetype="blabla" ...

They keep on not using index="", because you know, it works... they are searching all the indexes they've got access to with their roles and it's quite annoying when they should really specify an index there.

Do you have any advice on how to introduce that? I read about some filter that could be applied in the past with srchFilter or even thought of removing the Default indexes from their roles but not really sure which work best.

Thank you all, sorry if it's an easy question.

Ps: yes, my users are quite stubborn sometimes, I already won the "all time" challenge  😉 

[richgalloway]

I recommend removing the default indexes from their roles.  Once searches stop working they'll learn to use index=.

[llacoste]

Thought I would do that but I don't really know if that's the best "splunky" way of dealing with it as there is always 10 ways of doing things with Splunk ahah.

I'll try it thank you. I'm sure they'll love it 😄

[richgalloway]

That is the best way, IMO.  Search filters may be able to accomplish the goal, but they tend to be easy to work around and a challenge to manage.

Workload Management's "Admission Rules" feature has the potential for doing this very well, but lacks the ability to test for the absence of something.  You can block "index=*", for example, but can't determine if an index was not specified.