topic Search view that only searches on specified index in Splunk Search

Search view that only searches on specified index

mplacido — Mon, 24 Oct 2011 16:54:34 GMT

Hi,

I'm trying to create a Search view that only searches on the index I specify. But I don't seem to figure out how.
This should be very simple, but I can't find anything on how to do this. Is it possible?

Re: Search view that only searches on specified index

jbsplunk — Mon, 24 Oct 2011 18:49:55 GMT

just start your search with 'index=my_index'

Re: Search view that only searches on specified index

gkanapathy — Mon, 24 Oct 2011 20:06:27 GMT

There isn't a totally easy way to do this, other than to construct your view to prepend index=myindex to every base search on the page. This isn't trivial in some cases. Unfortunately, defaulting or restricting automatically is only available to roles, not views. This is a reasonable enhancement request, I think.

Re: Search view that only searches on specified index

mplacido — Tue, 25 Oct 2011 08:25:09 GMT

After som digging I actually figured it out myself.

I cloned the dasboard view, and added this lines to the xml after the Submit button module parameters.

addterm

myindexname

and then just added the before the Submit module´s

And now every search I make in this view automatically adds index="myindexname" without others seeing it.