Splunk Enterprise Security: Logs not being displayed on search head unless index name is specified explicitly

[deepakgaonkar]

Hi All,

I've seen an issue where a particular string is searched, the search head displays only the logs which are indexed under os and not all the logs. To search for a specific log file we had to mention the index name under which it was being logged.
Ideally, Splunk should have searched for all the occurrences where the log is present and shown all the source_types.

exp: Searched for abc* (without mentioning any index name) -> this would show only under the index os .
But abc_log is also indexed explicitly under os_abc index .
if searched explicitly index=os_abc the expected logs are displayed

[Vijeta · Accepted solution]

@deepakgaonkar These settings are specified for each role under authorize.conf. The srchIndexesDefault parameter is set to os in you case so whenever you do not specify any index it only searches in the default index assigned to your role which is os in your case. Try using index=* abc* you will find the string, but index=* is not recommended as it will search all the indexes for the string match. Is better to be precise with the index names if you know them.

[deepakgaonkar]

@Vijeta , Many thanks for the response . Its just that unless you know under which index name the log or text is defined , it would misguide . In my case when i searched for abc and searched it did not show the sourcetype or the source i was looking for , which made me assume that it is not being logged. Later when i checked the DS and then the UF's input.conf i understood its being logged but under different index name .
Completely agree with you to refine and better searching index name should be specified .
Many thanks for your help again !