topic Re: Cannot see data that gets indexed on Summary page in Splunk Search

Cannot see data that gets indexed on Summary page

efelder0 — Fri, 11 May 2012 14:21:57 GMT

Recently, I have made changes to my Splunk environment where I created new indexes and assigned multiple data sources to their respective indexes. However, once I index a single data source, that information no longer shows up on the Summary page. i.e. the message, "Waiting for data" appears in the Sources window.

Thoughts?

Re: Cannot see data that gets indexed on Summary page

sdaniels — Fri, 11 May 2012 14:30:42 GMT

The default view for the Search app summary page is only going to show data from the main index. If you want to see other sources you'll need to add that index as a default for the role of the user you are logging in as. Then you'll see the sources by default instead of having to type in index="whatever".

Re: Cannot see data that gets indexed on Summary page

efelder0 — Fri, 11 May 2012 14:35:16 GMT

would a .conf file need to be changed or a setting w/in the app?

Re: Cannot see data that gets indexed on Summary page

sdaniels — Fri, 11 May 2012 14:38:43 GMT

You can do either but throught the app is probably easiest. Look up the user to see what role they have. Then Manager -> Access Controls -> Roles. Then you'll see a box for 'Indexes searched by default'. Remember this change will apply to all users of that Role.

Re: Cannot see data that gets indexed on Summary page

efelder0 — Fri, 11 May 2012 14:42:05 GMT

I got it, Splunk --> Manager --> Access Controls --> Admin