Splunk Search

Why no events returned if using "*" to search instead of "index=*"

TrangCIC81
Communicator

Hi,

From the context menu of a "username" field value I choose "new search", then the below SPL was automatically added into the search bar and returned 0 events.

* user="aaa"

However if I changed the SPL to index=* user="aaa" then it showed events related to that user.

Why * user="aaa" did not work?

 

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your default indexes to search is probably set to a specific index/indexes, so unless you specify the index you will not find results.

Note that it is always a good idea to make your searches as specific as possible so that your search does not hog resources on the servers.

It is always a good idea to specify an index and sourcetype in your searches and then if you need to search wider, then increase the scope.

 

isoutamo
SplunkTrust
SplunkTrust

Hi

as @bowesmana said you have set srchIndexesDefault

srchIndexesDefault = <semicolon-separated list>
* A list of indexes to search when no index is specified.
* These indexes can be wild-carded ("*"), with the exception that "*" does not
  match internal indexes.
* To match internal indexes, start with an underscore ("_"). All internal indexes are
  represented by "_*".
* The wildcard character "*" is limited to match either all the non-internal
  indexes or all the internal indexes, but not both at once.
* No default.

Personally I always suggest that this should never set anything else than empty/null value. In long run it generates more issues for your users as they don't learn to use index=xyz if there are some indexes set here. Also when this is set by role they have totally different combination of default indexes based on which roles has granted to them.

If you set this as *, then it generate performance issues quite easily if/when you have tens/hundreds of indexes.

r. Ismo

 

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...