topic Unable to search using Sourcetype in Getting Data In

Unable to search using Sourcetype

olavo123 — Mon, 28 Sep 2020 18:02:01 GMT

I have set up a indexer which I also use as an Search Head. I dont have a deployment server so I manually pushed (copied) the apps to the servers to configure the forwarders. The forwarders work just fine and are recognized by the Indexer. And the props as well as input apps work well. And I am able to search for the index data using:

index="test_index" sourcetype=test_sourcetype

All fields defined in props and transform file, show up correctly. These fields also show correctly: host, source and sourcetype. I can see "sourcetype=test_sourcetype" in the events. But I am unable search events using:

sourcetype=test_sourcetype

Any help will be appreciated.

Thanks

Olavo

Re: Unable to search using Sourcetype

olavo123 — Fri, 24 Oct 2014 15:26:59 GMT

I forgot to add that : Both indexer and Forwarders are version 6.1.

Thanks

Olavo

Re: Unable to search using Sourcetype

olavo123 — Fri, 24 Oct 2014 15:57:49 GMT

Also, I see that I cannot use the fields "host" to perform any searches. I have to use the index= " ", then only other options like "host" , etc become operational.

-Olavo

Re: Unable to search using Sourcetype

jluste — Fri, 24 Oct 2014 17:51:14 GMT

It was my understanding that by default, the user roles only allow searches against index=main. If you wanted to default into other indexes, you'd have to update your roles per app behavior.

Re: Unable to search using Sourcetype

MartinMcNutt — Fri, 24 Oct 2014 18:03:26 GMT

If you wish to have custom indexes searched by default you must update your Role(s) to include that index as part of the "Indexes searched by default."

Settings
Access controles
Roles
Select Role(s)
Scroll down to "Indexes searched by default"
Add test_index
Click SAVE

Re: Unable to search using Sourcetype

martin_mueller — Fri, 24 Oct 2014 20:11:54 GMT

Note, this is unrelated to the app but rather controlled by the user's role.

Re: Unable to search using Sourcetype

jluste — Mon, 27 Oct 2014 19:07:42 GMT

Yes, that's it. But I thought that this could also be set per application. Do the user roles allow per app settings? (Not an admin)