topic Index Data Missing in Security

Index Data Missing

shangshin — Mon, 28 Sep 2020 12:21:25 GMT

Hi,
I created a new index location "my_apache" dedicated for a sourcetype "my_apache_access_log"
I am able to see data returns when use any of the two search strings:

index="my_apache"
  index="my_apache" sourcetype="my_apache_access_log"

However, no data is returned when I just entered sourcetype="my_apache_access_log"

Does this mean I have to explicitly enter the index name created by myself?

Another question is how come the sourcetype type ("my_apache_access_log"
) is not listed in the "All index data" dashboard?
Appreciate if anyone can shed some light on this!

Re: Index Data Missing

sdaniels — Thu, 30 Aug 2012 18:51:34 GMT

Take a look at access controls. Manager » Access controls » Roles » admin

If you look at a role, there are indexes that they have access to and there is a section called "Indexes searched by default". If you add your new index there, it will be searched by default for that role and you won't need to specify the index. Then, it will also show up under all indexed data by default as well.

By the way, for Apache data you should use the Splunk pre-trained sourcetype. The field extractions are all done for you.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Listofpretrainedsourcetypes

Re: Index Data Missing

shangshin — Thu, 30 Aug 2012 19:08:48 GMT

That's the right solution. Thanks!