Splunk Search

Why does searching "index=cisco_ios sourcetype=cisco:ios" return results, but "sourcetype=cisco:ios" does not?

kiran331
Builder

Hi

I'm not able to search only with sourcetype=cisco:ios, When I do index=cisco_ios sourcetype=cisco:ios, it's working, but why? Is there anything I need to change to make it work?

I'm getting the Cisco-ios logs through syslog.

0 Karma
1 Solution

somesoni2
Revered Legend

For Users/Roles, there is a setting (in Settings->Access Control) which you set the "Indexes searched by Default" when no index is set. Based on your issue, the either you don't have any defaultly searched index OR index cisco_ios is not in that list. So adding that index to your list of indexes searched by default will solve the issue.

Being said that, it's always advisable, from performance perspective, that you specify the index you need to search, to cut down the number of indexes/buckets to be searches.

See this for steps on how to edit user roles from Splunk web
http://docs.splunk.com/Documentation/Splunk/6.4.3/Security/Addandeditroles

View solution in original post

somesoni2
Revered Legend

For Users/Roles, there is a setting (in Settings->Access Control) which you set the "Indexes searched by Default" when no index is set. Based on your issue, the either you don't have any defaultly searched index OR index cisco_ios is not in that list. So adding that index to your list of indexes searched by default will solve the issue.

Being said that, it's always advisable, from performance perspective, that you specify the index you need to search, to cut down the number of indexes/buckets to be searches.

See this for steps on how to edit user roles from Splunk web
http://docs.splunk.com/Documentation/Splunk/6.4.3/Security/Addandeditroles

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...