topic Re: Specify App Name in Splunk Query in Splunk Search

Specify App Name in Splunk Query

VS0909 — Mon, 19 Jul 2021 11:49:53 GMT

I want to execute a query in app1, but I want to get the data from app2

For eg:

Execute query in app1 "index="abc", This should get the data from app2

Please help!

Re: Specify App Name in Splunk Query

richgalloway — Mon, 19 Jul 2021 12:49:11 GMT

Apps don't contain data - indexes do.

Please describe the problem you are trying to solve.

Re: Specify App Name in Splunk Query

VS0909 — Mon, 19 Jul 2021 13:22:50 GMT

I am using index="abc" . When I run this in app1 and app2, I get different data. I am selecting app from Splunk UI.

Can I specify app name in Splunk query?

Re: Specify App Name in Splunk Query

VS0909 — Mon, 19 Jul 2021 16:59:27 GMT

Can someone please help on the below query?

I am using index="abc" . When I run this in app1 and app2, I get different data. I am selecting app from Splunk UI.

Can I specify app name in Splunk query?

Re: Specify App Name in Splunk Query

richgalloway — Mon, 19 Jul 2021 18:48:07 GMT

When you say "I get different data" do you mean different events or different fields? Getting different fields is expected if the field extractions are limited to the app in which they are installed. If you change them to Global access then any app should see them.

Re: Specify App Name in Splunk Query

VS0909 — Tue, 20 Jul 2021 02:41:53 GMT

Hi, Can I specify app name in Splunk query?