Getting Data In

Add index to default searched index in splunk light.

matt_squaretrad
Engager

I'm forwarding traffic from a window file server to a splunk light instance. The index where the data is received is wineventlog. That index isn't searchable. How do I add that index to the default indexes being searched? The windows server uses the universal forwarder.

Information I'm seeing on this topic seems to references making role changes, but this isn't showing as an option in Splunk light 6.3.3

mkallies
Path Finder

I was able to get this working on Splunk Light with the following in /opt/splunk/etc/system/local/authorize.conf

[default]
[role_user]
srchIndexesAllowed = *
srchIndexesDefault = main;wineventlog

[role_admin]
srchIndexesAllowed = *;_*
srchIndexesDefault = main;os;wineventlog

The Splunk Enterprise parameters seem to work ok here:

http://docs.splunk.com/Documentation/Splunk/6.2.0/Security/Addandeditroleswithauthorizeconf

I copied and edited the parameters from etc/system/default/authorize.conf

0 Karma

jterry
Splunk Employee
Splunk Employee

not searchable? have you tried "index=wineventlog *"

jterry
Splunk Employee
Splunk Employee

not searchable? have you tried "index=wineventlog *"

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...