topic Re: Unable to search from "MAIN" index in Splunk Search

Why am I unable to search from "MAIN" index?

sidtalup27 — Tue, 08 Nov 2022 15:51:27 GMT

Hello,

I have installed an App, and the data in APP is written to "MAIN" index. When I am search for DATA from the APP, it works fine. Below is the my search query
index="main" source=jira

However, when I search for the same data from Search App, the data is not visible, and hence when I try to create a dashboard, it is not functional.

How can I make data searchable from Search App and from the App. Please advise.

--
Thanks in Advance.
Siddarth

Re: Unable to search from "MAIN" index

gcusello — Mon, 07 Nov 2022 10:24:55 GMT

Hi @sidtalup27m,

probably in your search there's something (an eventtype, or a field) that isn't share as global, so you don't see outside the App.

Ciao.

Giuseppe

Re: Unable to search from "MAIN" index

sidtalup27 — Mon, 07 Nov 2022 10:32:28 GMT

Hello @gcusello ,

Thank you for your response. Can you please elaborate. How can I fix it.

Thanks in Advance
Siddarth

Re: Unable to search from "MAIN" index

gcusello — Mon, 07 Nov 2022 10:35:16 GMT

Hi @sidtalup27 ,

What are the searches that run in the app and don't outside?

please share them.

If there are fields or eventtypes, you have to change the permissions on these objects.

Ciao.

Giuseppe