On our Splunk 5 system I can search for a sourcetype and it will be found in any non-internal index. For example, searching for 'sourcetype=foo
' will find matching events in the default index as well as in index 'bar'.
On our Splunk 6 system, however, the same search returns no results if the event is not in the default index. I have to specify the index to find events not in the default index ('sourcetype=foo index=bar
', for example).
Is this change in behavior intentional? I haven't seen mention of it in the release notes.
That change is nothing to do with Splunk 6. In fact, the behavior you describe is "out of the box" behavior for Splunk 5 as well. Your Splunk 5 installation has configured your user role (or perhaps your user, specifically) for "indexes searched by default" to be "all non-internal indexes". You could make the same change to roles on 6 to restore the behavior.
That change is nothing to do with Splunk 6. In fact, the behavior you describe is "out of the box" behavior for Splunk 5 as well. Your Splunk 5 installation has configured your user role (or perhaps your user, specifically) for "indexes searched by default" to be "all non-internal indexes". You could make the same change to roles on 6 to restore the behavior.