• https://docs.splunk.com/Documentation/Splunk/9.0.4/Security/Aboutusersandroles

If you do not specify an index as "index=xxx" in the search statement, the index to be searched will be the default search index set for each role.

How to check which index is searched by default

• Log in as a user with admin privileges, and from Splunk Web Settings > Roles, click the role name set for the user who performed the search.
• Check the index selected as default from "3. Index" in the reference image.

reference image

In the image below, the default column "main" is checked, so if no index is specified in the search statement, the "main" index will be searched.

To search an index other than the above, specify the index name in the search statement.

that's all