topic Index not on searches in Splunk Search

Index not on searches

DerekKing — Tue, 25 Jun 2013 16:20:55 GMT

Hi,

The app seems to use eventtypes and not specify the index on searches. I can see that all events get forced to the index "ios" but without specifying the index for searching no events are picked up.

I understand splunk only searches "main" if you don't put the index in, so why would the searches in this app not specify index="ios" please ?

I know I must be missing something, but at this point it looks like I have to change every search to include index="ios".

Many Thanks
Derek

Re: Index not on searches

sowings — Tue, 25 Jun 2013 16:31:22 GMT

1) To which app are you referring?

2) You can adjust the list of indexes searched by default (that is, unless you provide an index= keyword in your search) by visiting the Splunk Manager > Access Controls > Roles > <select role>, then update the list of default indexes. Out of the box, it's only "main".

Re: Index not on searches

DerekKing — Tue, 25 Jun 2013 16:39:39 GMT

Ahh posted incorrectly. I was referring to CiscoIos, but you have resolved my issue thankyou.

Regards
Derek