Splunk
SPLK-3003 · Question #21
SPLK-3003 Question #21: Real Exam Question with Answer & Explanation
The correct answer is A. Set the authorize.conf setting: srchIndexesDefault to no value.. https://community.splunk.com/t5/Archive/srchIndexesDefault-parameter-is-not-respected-when- srchFilter-is/m-p/495869
Question
How could a role in which all users must specify an index=clause in all searches be configured?
Options
- ASet the authorize.conf setting: srchIndexesDefault to no value.
- BSet the authorize.conf setting: srchFilter to no value.
- CSet the authorize.conf setting: srchIndexesAllowed to no value.
- DSet the authorize.conf setting: srchJobsQuota to no value.
Explanation
https://community.splunk.com/t5/Archive/srchIndexesDefault-parameter-is-not-respected-when- srchFilter-is/m-p/495869
Community Discussion
No community discussion yet for this question.