Why no events returned if using "*" to search instead of "index=*"

[TrangCIC81]

Hi,

From the context menu of a "username" field value I choose "new search", then the below SPL was automatically added into the search bar and returned 0 events.

* user="aaa"

However if I changed the SPL to index=* user="aaa" then it showed events related to that user.

Why * user="aaa" did not work?

[bowesmana]

Your default indexes to search is probably set to a specific index/indexes, so unless you specify the index you will not find results.

Note that it is always a good idea to make your searches as specific as possible so that your search does not hog resources on the servers.

It is always a good idea to specify an index and sourcetype in your searches and then if you need to search wider, then increase the scope.

[isoutamo]

Hi

as @bowesmana said you have set srchIndexesDefault

srchIndexesDefault = <semicolon-separated list>
* A list of indexes to search when no index is specified.
* These indexes can be wild-carded ("*"), with the exception that "*" does not
  match internal indexes.
* To match internal indexes, start with an underscore ("_"). All internal indexes are
  represented by "_*".
* The wildcard character "*" is limited to match either all the non-internal
  indexes or all the internal indexes, but not both at once.
* No default.

Personally I always suggest that this should never set anything else than empty/null value. In long run it generates more issues for your users as they don't learn to use index=xyz if there are some indexes set here. Also when this is set by role they have totally different combination of default indexes based on which roles has granted to them.

If you set this as *, then it generate performance issues quite easily if/when you have tens/hundreds of indexes.

r. Ismo