Splunk Search

Search without index not working

aupadhya
New Member

I installed latest Splunk and added splunkforwarder to index log data. Everything looks fine except that search doesn't return any data without specifying the index name, i.e

sourcetype="jetty"

doesn't work

but

index="app" sourcetype="jetty"

works

Any reason why search doesn't work without the index in the search query?

Tags (1)
0 Karma

rishrai
New Member

set default in access control as: index!=_*

0 Karma

the_wolverine
Champion

Assuming the data exists, this behavior is dependent on the default settings for the role. If you want the "app" index to be searchable by default, just add that index to "Indexes searched by default" for the role in question.

alt text

Ayn
Legend

By default only the main index is searched. You can change which indexes are searched by default for a user and/or role in the manager in the web interface, Manager -> Access Controls.

aupadhya
New Member

Thanks a lot

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...