Splunk Search

Search query requirements

bleung93
Path Finder

Is it possible to require fields in a search query for specific users/roles?

Non-power users or admins, they must have the search field index= sourcetype= source=

What would you have to do? Edit somewhere in the search app?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Ah, I see. I don't think there's a way to force people into specifying a source or sourcetype, but you can force lower roles to specify indexes by removing their searched-by-default indexes. Keep in mind though, they can just specify index=* and you're back to square one.
Another way to reduce inadvertent load is to reduce the time range searchable by lower roles to a week, a month, or whatever makes sense in your roles' scenarios. Another caveat here, make sure you're not killing the usability of Splunk for them by restricting the range too much.
Consider giving them smart accelerated data models so they use the Pivot interface instead of building reports manually.
Depending on the scenario, build custom forms for certain tasks that hide the search language a bit.

However, the best thing to do is user education. Your server load will drop, and users' productivity will go up - win win.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Ah, I see. I don't think there's a way to force people into specifying a source or sourcetype, but you can force lower roles to specify indexes by removing their searched-by-default indexes. Keep in mind though, they can just specify index=* and you're back to square one.
Another way to reduce inadvertent load is to reduce the time range searchable by lower roles to a week, a month, or whatever makes sense in your roles' scenarios. Another caveat here, make sure you're not killing the usability of Splunk for them by restricting the range too much.
Consider giving them smart accelerated data models so they use the Pivot interface instead of building reports manually.
Depending on the scenario, build custom forms for certain tasks that hide the search language a bit.

However, the best thing to do is user education. Your server load will drop, and users' productivity will go up - win win.

0 Karma

bleung93
Path Finder

You are right about educating users. Currently not using Splunk 6 to use the Pivot feature yet though.

0 Karma

bleung93
Path Finder

Situation: You are in a company that uses Splunk. Most of the users there are inexperienced with Search & Reporting.

Goal: You want to keep indexers from over allocating the resources to execute searches that are not properly created. (e.g. error OR warn "System Failure")

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What are you trying to achieve?

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...