Installation

Default indexes in Splunk free?

jamesez
New Member

I am running Splunk 4.1.7 in the free license mode.

I added an index "noise" and created a transform that moves some events to it (e.g., ssh attempts).

Any * search is grabbing entries out of "main" and "noise," which does not agree with the manual and other information provided here. I have verified the transforms do work, as they show up "index=noise" when that is added to the results view.

Is setting default indexes for searching limited to the enterprise license?

Tags (1)
0 Karma
1 Solution

jrodman
Splunk Employee
Splunk Employee

Sure enough, the default index set is '*' in Splunk Free.

void UserManagerFree::getDefaultIndexes(std::set<Str> &indexes)
{
    indexes.clear();

    // Use all public indexes
    AuthorizationManagerSplunk::addMatchingIndexes("*", indexes);
}

This seems consistent with http://www.splunk.com/view/how-to-get-splunk/SP-CAAADFV which indicates that Free does not offer role based access controls. Essentially, all indexes are searched, unless manually specified.

However, we should possibly expand the section http://www.splunk.com/base/Documentation/latest/Installation/MoreAboutSplunkWithAFreeLicense since the default is definitely different in this case.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

Sure enough, the default index set is '*' in Splunk Free.

void UserManagerFree::getDefaultIndexes(std::set<Str> &indexes)
{
    indexes.clear();

    // Use all public indexes
    AuthorizationManagerSplunk::addMatchingIndexes("*", indexes);
}

This seems consistent with http://www.splunk.com/view/how-to-get-splunk/SP-CAAADFV which indicates that Free does not offer role based access controls. Essentially, all indexes are searched, unless manually specified.

However, we should possibly expand the section http://www.splunk.com/base/Documentation/latest/Installation/MoreAboutSplunkWithAFreeLicense since the default is definitely different in this case.

jrodman
Splunk Employee
Splunk Employee

I'm not sure how it was described originally. In 3.x, we could only search one index at a time, so there was a single default. Maybe you found text from that timeframe? In early 3.x, custom indexes were not supported in Splunk Free at all, so that informed the historical choice. In any event, perhaps you could spell out how you feel it should work and why in an enhancement request? Those requests are helpful to us! These are currently submitted by the spunk support portal.

0 Karma

jamesez
New Member

I'd prefer it if the way it was described originally is how it was implemented, and not *.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...