How could a role in which all users must specify an index=clause in all searches be configured?
How could a role in which all users must specify an index=clause in all searches be configured?
To configure a role in which all users must specify an index=clause in all searches, you should set the authorize.conf setting: srchIndexesDefault to no value. By doing so, users are not provided with any default indexes to search, thus necessitating the explicit specification of an index in their search queries.
Should be A https://community.splunk.com/t5/Archive/srchIndexesDefault-parameter-is-not-respected-when-srchFilter-is/m-p/495869 The B option only limits what indexes they search by default
Correct is A, if you dont give default indexes
A is the correct
I think that the answer is "A"
The correct answer is A.