topic Re: Changing the default index after installation. in All Apps and Add-ons

Changing the default index after installation.

jparct — Mon, 06 Nov 2017 17:15:01 GMT

I selected the main index mistakenly during the installation of the Splunk app and add-on for Okta. How do I change this so that the correct index is selected automatically? The index I configured is collecting data as I can specify index=okta in a search and receive current information, it's just that the dashboards aren't displaying the any current information. Splunk 6.6.0 installed on a Ubuntu server.

Thanks.

Re: Changing the default index after installation.

hardikJsheth — Tue, 07 Nov 2017 05:49:45 GMT

One possible solution would be to create a new role , put "okta" as a default index for the role and then assign this role to the users who should be accessing the dashboards.

Re: Changing the default index after installation.

koshyk — Tue, 07 Nov 2017 09:21:29 GMT

The best practice for index is the administrator to have overall control over all indexes.conf configuration. What we do is we create a single app with all index configurations and disable index configuration in all other apps.
So in your case, the best way is

In your inputs.conf, ensure you make an entry index=okta in your monitor stanza along && correct sourcetype
Disable any index=main in your app or default apps for the above sourcetype (if it exists). You can check this using btool
enable the index settings in indexes.conf for index=okta providing correct bucket settings, rollover settings etc.

=========== example below ======

#inputs.conf
[monitor:///mycollection/location/filename]
sourcetype=required_okta_sourcetype
index = okta
blacklist = \.gz$

# indexes.conf

    [okta]
    homePath   = volume:home/okta/db
    coldPath   = volume:cold/okta/colddb
    thawedPath = $SPLUNK_DB/okta/thaweddb
    tstatsHomePath = volume:home/okta/datamodel_summary
    frozenTimePeriodInSecs = 34164000
    maxHotBuckets = 10
    maxDataSize = auto_high_volume

Re: Changing the default index after installation.

jparct — Tue, 07 Nov 2017 16:18:22 GMT

Thanks to those who answered. I opted to use the new role and set okta as the default index as it was the simplest solution. I will explore the other suggestions as well.

Re: Changing the default index after installation.

jparct — Tue, 07 Nov 2017 16:18:57 GMT

Thanks for this suggestion. I will explore this further.