topic Re: Problem with indexes except main in Getting Data In

Problem with indexes except main

RezaET — Tue, 27 Aug 2024 10:33:30 GMT

I installed cisco network add-on, but only main index work and I cannot store log in another index

Re: Problem with indexes except main

gcusello — Tue, 27 Aug 2024 10:37:28 GMT

Hi @RezaET ,

the issue probably is in the default search path:

by default only the main index is in the default search path and in apps the index isn't specified.

You have two solutions:

add the other indexes in the default search path,
add the index in all the searches of your app.

Ciao.

Giuseppe

Re: Problem with indexes except main

PickleRick — Tue, 27 Aug 2024 10:53:29 GMT

Can you be more verbose? What do you mean by "I cannot store log in another index". The TA itself shouldn't have anything to do with the indexes.

Re: Problem with indexes except main

RezaET — Tue, 27 Aug 2024 11:59:44 GMT

first, I created new UDP data input whit a new index "cisco"

but when I search index=cisco there was no event

then I create new UDP data input whit "main" index and I worked.

but I don't like to store my switch event in main index

Re: Problem with indexes except main

PickleRick — Tue, 27 Aug 2024 12:03:14 GMT

Have you created an index named "cisco" before creating inputs? You can't send events to a non-existent index.

If you haven't, the event will end up either in a last-chance index (if you have one configured) or discarded (and you'll get a warning in _internal about it).

Re: Problem with indexes except main

RezaET — Tue, 27 Aug 2024 12:10:34 GMT

yes, first I cedared index and then input. but it didn't work, only main index work

Re: Problem with indexes except main

PickleRick — Tue, 27 Aug 2024 13:33:13 GMT

That does indeed seem strange because you should be getting events into an index regardless of an add-on. The only things that could make you not see the events would be bad timestamp parsing (but that would happen regardless of destination index), bad timerange you're searching (ditto) or no permissions for the cisco index (but as you're saying you've created the index I'm assuming you've got admin rights here).

Try to run

| tstats count where index=cisco by source sourcetype

over all time and see if you get any results