Splunk Search

Why does searching "index=cisco_ios sourcetype=cisco:ios" return results, but "sourcetype=cisco:ios" does not?

kiran331
Builder

Hi

I'm not able to search only with sourcetype=cisco:ios, When I do index=cisco_ios sourcetype=cisco:ios, it's working, but why? Is there anything I need to change to make it work?

I'm getting the Cisco-ios logs through syslog.

0 Karma
1 Solution

somesoni2
Revered Legend

For Users/Roles, there is a setting (in Settings->Access Control) which you set the "Indexes searched by Default" when no index is set. Based on your issue, the either you don't have any defaultly searched index OR index cisco_ios is not in that list. So adding that index to your list of indexes searched by default will solve the issue.

Being said that, it's always advisable, from performance perspective, that you specify the index you need to search, to cut down the number of indexes/buckets to be searches.

See this for steps on how to edit user roles from Splunk web
http://docs.splunk.com/Documentation/Splunk/6.4.3/Security/Addandeditroles

View solution in original post

somesoni2
Revered Legend

For Users/Roles, there is a setting (in Settings->Access Control) which you set the "Indexes searched by Default" when no index is set. Based on your issue, the either you don't have any defaultly searched index OR index cisco_ios is not in that list. So adding that index to your list of indexes searched by default will solve the issue.

Being said that, it's always advisable, from performance perspective, that you specify the index you need to search, to cut down the number of indexes/buckets to be searches.

See this for steps on how to edit user roles from Splunk web
http://docs.splunk.com/Documentation/Splunk/6.4.3/Security/Addandeditroles

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...