How could a role in which all users must specify an index=clause in all searches be configured?

The srchIndexesDefault parameter in a role's stanza within authorize.conf specifies the default index or indexes to be searched if the user's search query does not contain an index= clause. By setting this parameter to no value (i.e., srchIndexesDefault =), you remove any default search path. Consequently, a search without an explicit index= clause will run against zero indexes, returning no results. This effectively compels users in that role to specify the target index in every search to retrieve data.

B. srchFilter is used to prepend a search string to all searches from a role; setting it to no value is the default and does not enforce any index specification.

C. srchIndexesAllowed defines which indexes a role is permitted to search. Setting it to no value would block the role from searching any index, which is not the goal.

D. srchJobsQuota controls the maximum number of concurrent search jobs for a role and has no impact on the content or requirements of the search string itself.

1. Splunk Enterprise Documentation, authorize.conf:

File: authorize.conf.spec

Section: [role]

Parameter: srchIndexesDefault

Content: "Specifies the indexes to search when no index is specified. These indexes are searched by default when a user of this role runs a search. If you want to require that users of this role specify an index in their searches, set srchIndexesAllowed and leave srchIndexesDefault blank." This directly supports answer A.

2. Splunk Enterprise Documentation, Securing Splunk Enterprise Manual:

Chapter: "Users and roles"

Section: "Add and edit roles"

Topic: "Restrict searches by role"

Content: The documentation explains that to force users to specify an index, an administrator should leave the "Default search indexes" field blank while populating the "Allowed search indexes" field when configuring a role. This corresponds directly to setting srchIndexesDefault to no value in authorize.conf.