In a deployment with multiple indexes, what will happen when a search is run and an index is not specified in the search string?
A) No events will be returned.
B) Splunk will prompt you to specify an index.
C) All non-indexed events to which the user has access will be returned.
D) Events from every index searched by default to which the user has access will be returned.

Question

Quizplus · Accepted Answer

If an index is not specified in the search string, Splunk will search through all the default indexes that the user has access to and return events from those indexes.

In a Deployment with Multiple Indexes, What Will Happen When