Splunk Search

How do I set the default search index in Splunk Light?

jrailton
Engager

In Splunk Enterprise you can set the default search index per user. In Splunk Light you cannot it seems?

I read another post which said you can edit the \etc\system\default\indexes.conf file and set defaultDatabase=my_new_index

And yet another post that said you should create \etc\system\local\indexes.conf file and set defaultDatabase=my_new_index

I tried both and restarted Splunk after each, but neither have made a difference.

0 Karma
1 Solution

dkoshe_splunk
Splunk Employee
Splunk Employee

create new file \etc\system\local\authorize.conf and add following stanza, to make that index searchable by default for all users:

[role_user]
srchIndexesDefault = main;my_new_index

If you want to restrict it to only Administrators, then use following stanza instead:

[role_admin]
srchIndexesDefault = main;my_new_index

and then restart Splunk Light.
Changing indexes.conf, will only change your default index when importing data.
Also, @somesoni2 is correct, you should never update conf files under default, as they will get overwritten upon updates.
Hope this helps.

View solution in original post

dkoshe_splunk
Splunk Employee
Splunk Employee

create new file \etc\system\local\authorize.conf and add following stanza, to make that index searchable by default for all users:

[role_user]
srchIndexesDefault = main;my_new_index

If you want to restrict it to only Administrators, then use following stanza instead:

[role_admin]
srchIndexesDefault = main;my_new_index

and then restart Splunk Light.
Changing indexes.conf, will only change your default index when importing data.
Also, @somesoni2 is correct, you should never update conf files under default, as they will get overwritten upon updates.
Hope this helps.

somesoni2
Revered Legend

The Splunk Light doesn't support role customization (the default searched index is role/user level attribute).

Also, you should never change any configuration from folder \etc\system\default\.

MuS
Legend

"all these worlds are yours, except /default - attempt no editing there"

-- @duckfez, 2010

http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Configurationfiledirectories

Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...