Splunk Search

Why do I get no results when search internal indexes?

Splunk Employee
Splunk Employee

Why does the search index=_internal not return any results?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Please add the config to your local authorize.conf file to the one below, restart splunk and now try to search

srchIndexesAllowed = ;_

You can find more on this config in the link below

http://docs.splunk.com/Documentation/Splunk/6.0/admin/authorizeconf

View solution in original post

Splunk Employee
Splunk Employee

Please add the config to your local authorize.conf file to the one below, restart splunk and now try to search

srchIndexesAllowed = ;_

You can find more on this config in the link below

http://docs.splunk.com/Documentation/Splunk/6.0/admin/authorizeconf

View solution in original post