From the document, if index=myindex was not mentioned, Splunk search will only use default indexes. However, I found that the behaviour is not true anymore. When I run a search, result return from non default index as well.
What is the possible cause?
You can check whether srchFilter is set in your role.
For example,
authorize.conf
[default]
srchFilter = NOT index=*_archive
If you have set srchFilter to some value, it will get added to every search for this role.
As your srchFilter exist, it includes an “index=“ line and Splunk is not going to look at the srchIndexesDefault parameter.