Splunk Search

Search query requirements

bleung93
Path Finder

Is it possible to require fields in a search query for specific users/roles?

Non-power users or admins, they must have the search field index= sourcetype= source=

What would you have to do? Edit somewhere in the search app?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Ah, I see. I don't think there's a way to force people into specifying a source or sourcetype, but you can force lower roles to specify indexes by removing their searched-by-default indexes. Keep in mind though, they can just specify index=* and you're back to square one.
Another way to reduce inadvertent load is to reduce the time range searchable by lower roles to a week, a month, or whatever makes sense in your roles' scenarios. Another caveat here, make sure you're not killing the usability of Splunk for them by restricting the range too much.
Consider giving them smart accelerated data models so they use the Pivot interface instead of building reports manually.
Depending on the scenario, build custom forms for certain tasks that hide the search language a bit.

However, the best thing to do is user education. Your server load will drop, and users' productivity will go up - win win.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Ah, I see. I don't think there's a way to force people into specifying a source or sourcetype, but you can force lower roles to specify indexes by removing their searched-by-default indexes. Keep in mind though, they can just specify index=* and you're back to square one.
Another way to reduce inadvertent load is to reduce the time range searchable by lower roles to a week, a month, or whatever makes sense in your roles' scenarios. Another caveat here, make sure you're not killing the usability of Splunk for them by restricting the range too much.
Consider giving them smart accelerated data models so they use the Pivot interface instead of building reports manually.
Depending on the scenario, build custom forms for certain tasks that hide the search language a bit.

However, the best thing to do is user education. Your server load will drop, and users' productivity will go up - win win.

0 Karma

bleung93
Path Finder

You are right about educating users. Currently not using Splunk 6 to use the Pivot feature yet though.

0 Karma

bleung93
Path Finder

Situation: You are in a company that uses Splunk. Most of the users there are inexperienced with Search & Reporting.

Goal: You want to keep indexers from over allocating the resources to execute searches that are not properly created. (e.g. error OR warn "System Failure")

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What are you trying to achieve?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...