Splunk Search

Search query requirements

bleung93
Path Finder

Is it possible to require fields in a search query for specific users/roles?

Non-power users or admins, they must have the search field index= sourcetype= source=

What would you have to do? Edit somewhere in the search app?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Ah, I see. I don't think there's a way to force people into specifying a source or sourcetype, but you can force lower roles to specify indexes by removing their searched-by-default indexes. Keep in mind though, they can just specify index=* and you're back to square one.
Another way to reduce inadvertent load is to reduce the time range searchable by lower roles to a week, a month, or whatever makes sense in your roles' scenarios. Another caveat here, make sure you're not killing the usability of Splunk for them by restricting the range too much.
Consider giving them smart accelerated data models so they use the Pivot interface instead of building reports manually.
Depending on the scenario, build custom forms for certain tasks that hide the search language a bit.

However, the best thing to do is user education. Your server load will drop, and users' productivity will go up - win win.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Ah, I see. I don't think there's a way to force people into specifying a source or sourcetype, but you can force lower roles to specify indexes by removing their searched-by-default indexes. Keep in mind though, they can just specify index=* and you're back to square one.
Another way to reduce inadvertent load is to reduce the time range searchable by lower roles to a week, a month, or whatever makes sense in your roles' scenarios. Another caveat here, make sure you're not killing the usability of Splunk for them by restricting the range too much.
Consider giving them smart accelerated data models so they use the Pivot interface instead of building reports manually.
Depending on the scenario, build custom forms for certain tasks that hide the search language a bit.

However, the best thing to do is user education. Your server load will drop, and users' productivity will go up - win win.

0 Karma

bleung93
Path Finder

You are right about educating users. Currently not using Splunk 6 to use the Pivot feature yet though.

0 Karma

bleung93
Path Finder

Situation: You are in a company that uses Splunk. Most of the users there are inexperienced with Search & Reporting.

Goal: You want to keep indexers from over allocating the resources to execute searches that are not properly created. (e.g. error OR warn "System Failure")

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What are you trying to achieve?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...