view default index

[trojan_81]

How can I view the default index of a user?

In other words, if user runs a search within splunk search app and does not specify an index, how do i view which index he will default at?

[richgalloway]

Check the user's role.  That role may have one or more default indexes defined.  A search that doesn't specify an index will look in all of the defined default indexes.

[isoutamo · Accepted solution]

Hi
In https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Authorizeconf is role specific parameter: srchIndexesDefault which define this. If user have several roles or inherited roles then those all must combine.
Maybe this https://community.splunk.com/t5/Splunk-Search/is-there-a-way-to-search-who-has-access-to-an-index/m-... helps to figure out spl query to get this information.
r. Ismo