How could a role in which all users must specify an index=clause in all searches be configured?

The correct answer is A. Set the authorize.conf setting: srchIndexesDefault to no value. https://community.splunk.com/t5/Archive/srchIndexesDefault-parameter-is-not-respected-when- srchFilter-is/m-p/495869

Security and Compliance Considerations

Question

Options

ASet the authorize.conf setting: srchIndexesDefault to no value.
BSet the authorize.conf setting: srchFilter to no value.
CSet the authorize.conf setting: srchIndexesAllowed to no value.
DSet the authorize.conf setting: srchJobsQuota to no value.

How the community answered

(42 responses)

A
81% (34)
B
5% (2)
C
12% (5)
D
2% (1)

Explanation

https://community.splunk.com/t5/Archive/srchIndexesDefault-parameter-is-not-respected-when- srchFilter-is/m-p/495869

Topics

#RBAC#authorize.conf#srchIndexesDefault#index enforcement

Community Discussion

No community discussion yet for this question.

Full SPLK-3003 Practice