https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231418#M188385 <P>When installing the Rapid7 App, I added to <CODE>$SPLUNK_HOME\etc\apps\rapid7\local\inputs.conf</CODE> under the [monitor] stanza <CODE>index=nexpose_index</CODE>. The data from the lookup tables is properly indexed into the correct index, although the dashboard and the saved searches are looking at the default index. Therefore, the dashboard shows "no results".</P> <P>I'd rather not use the default index for this data. Any help would be appreciated.</P> Wed, 04 May 2016 21:33:04 GMT windbishn 2016-05-04T21:33:04Z https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231418#M188385 <P>When installing the Rapid7 App, I added to <CODE>$SPLUNK_HOME\etc\apps\rapid7\local\inputs.conf</CODE> under the [monitor] stanza <CODE>index=nexpose_index</CODE>. The data from the lookup tables is properly indexed into the correct index, although the dashboard and the saved searches are looking at the default index. Therefore, the dashboard shows "no results".</P> <P>I'd rather not use the default index for this data. Any help would be appreciated.</P> Wed, 04 May 2016 21:33:04 GMT https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231418#M188385 windbishn 2016-05-04T21:33:04Z https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231419#M188386 <P>I haven't been able to find any reference to either sourcetypes or indexes in the dashboard configs. If anyone can see them, that would be enough I believe.</P> Mon, 09 May 2016 19:51:02 GMT https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231419#M188386 pdoconnell 2016-05-09T19:51:02Z https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231420#M188387 <P>If you send the data to a different index, then you will need to do one of two things:</P> <P>1) Examine all the saved searches and the inline searches in all of the dashboards. Add <CODE>index=nexpose_index</CODE> to all of them as appropriate.</P> <P>2) If the saved searches and inline searches contain <CODE>index=main</CODE>, then you need to change the searches (option #1). But if the searches do <EM>not</EM> indicate any index, then you can change the "indexes searched by default" for the roles that will be using this app. This change is made to the role(s), not the searches.</P> Tue, 10 May 2016 01:24:36 GMT https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231420#M188387 lguinn2 2016-05-10T01:24:36Z https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231421#M188388 <P>to build in @lguinn's answer above, you need to add "index=" to the beginning of the following objects:<BR /> r7vulnexceptiondata<BR /> r7vulnerabilitydata<BR /> r7assetdata</P> <P>They can all be found under the rapid7 app's Event Types, found at <A href="https://YOUR_HOST_NAME:8000/en-US/manager/search/saved/eventtypes">https://YOUR_HOST_NAME:8000/en-US/manager/search/saved/eventtypes</A></P> Tue, 10 May 2016 18:11:47 GMT https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231421#M188388 pdoconnell 2016-05-10T18:11:47Z https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231422#M188389 <P>Thanks for responding, that is what I thought to be the answer as well. Adding "index=" to the rapid7 app's eventtypes did work.</P> Wed, 11 May 2016 17:37:25 GMT https://community.splunk.com/t5/Splunk-Search/Rapid7-App-for-Splunk-Enterprise-How-to-change-the-quot-default/m-p/231422#M188389 windbishn 2016-05-11T17:37:25Z