Splunk Search

How to set up omit "index=xxx" when searching?

tchien
Engager

I log into the web interface using a particular id, and i'm only concerned about a particular index, which is not the default "main" index, right now i have to use "index=xxx" every time i search for something, is there a way to setup my personal web view so that the default searching index for ME is "index=xxx"?

Tags (2)
1 Solution

ziegfried
Influencer

You can assign one or more default indexes to a role. You can find that option in the Splunk Manager under Access controls » Roles.

View solution in original post

ziegfried
Influencer

You can assign one or more default indexes to a role. You can find that option in the Splunk Manager under Access controls » Roles.

tchien
Engager

Thank you very much for your help!

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...