Why does searching "index=cisco_ios sourcetype=cisco:ios" return results, but "sourcetype=cisco:ios" does not?

[kiran331]

Hi

I'm not able to search only with sourcetype=cisco:ios, When I do index=cisco_ios sourcetype=cisco:ios, it's working, but why? Is there anything I need to change to make it work?

I'm getting the Cisco-ios logs through syslog.

[somesoni2 · Accepted solution]

For Users/Roles, there is a setting (in Settings->Access Control) which you set the "Indexes searched by Default" when no index is set. Based on your issue, the either you don't have any defaultly searched index OR index cisco_ios is not in that list. So adding that index to your list of indexes searched by default will solve the issue.

Being said that, it's always advisable, from performance perspective, that you specify the index you need to search, to cut down the number of indexes/buckets to be searches.

See this for steps on how to edit user roles from Splunk web
http://docs.splunk.com/Documentation/Splunk/6.4.3/Security/Addandeditroles