Troubleshoot messages about default indexes searched by the admin role

Troubleshoot Splunk messages about default indexes searched by the admin role in the Splunk platform.

Default admin searches include summary indexes

When the admin role searches summary indexes by default, you can see decreased performance. You can stop seeing messages about this setting by limiting the indexes searched by the admin role or by disabling the search.

Limit the indexes searched by the admin role

Prevent the admin role from searching summary indexes. You can identify summary index names because the index names end in _summary, such as endpoint_summary.

1. Select Settings > Access controls.
2. Click Roles.
3. Click admin.
4. From Indexes click any summary index to remove it from the selected indexes.
5. Click Save.

Disable the search to prevent messages

If you do not want to limit the indexes searched by the admin role, but you want to stop seeing messages, disable the search.

1. Select Settings > Searches, reports, and alerts.
2. Locate the Audit - Default Admin Search Indexes search.
3. Select Edit > Disable.
4. Click Disable.

Default admin searches include all non-internal indexes

When the admin role searches all non-internal indexes by default, you can see decreased performance. You can stop seeing messages about this setting by limiting the indexes searched by the admin role or disabling the search.

Limit the indexes searched by the admin role

Prevent the admin role from searching all non-internal indexes.

1. Select Settings > Access controls.
2. Click Roles.
3. Click admin.
4. From Indexes click All non-internal indexes to remove it from the selected indexes.
5. Click Save.

Disable the search to prevent messages

If you do not want to limit the indexes searched by the admin role, but you want to stop seeing messages, disable the search.

1. Select Settings > Searches, reports, and alerts.
2. Locate the Audit - Default Admin Search All Non-Internal search.
3. Select Edit > Disable.
4. Click Disable.