The authorize.conf setting: srchIndexesDefault specifies the default indexes that are searched when a user does not specify an index in their search. If this setting is set to no value, then the user must specify an index in their search, otherwise they will get no results. Therefore, the correct answer is A. Set the authorize.conf setting: srchIndexesDefault to no value. References:
Splunk Core Certified Consultant Test Blueprint
Splunk Documentation: About authorize.conf
Splunk Documentation: Configure user roles with authorize.conf
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit