Changing the default index after installation.

[jparct]

I selected the main index mistakenly during the installation of the Splunk app and add-on for Okta. How do I change this so that the correct index is selected automatically? The index I configured is collecting data as I can specify index=okta in a search and receive current information, it's just that the dashboards aren't displaying the any current information. Splunk 6.6.0 installed on a Ubuntu server.

Thanks.

[koshyk]

The best practice for index is the administrator to have overall control over all indexes.conf configuration. What we do is we create a single app with all index configurations and disable index configuration in all other apps.
So in your case, the best way is

1. In your inputs.conf, ensure you make an entry index=okta in your monitor stanza along && correct sourcetype
2. Disable any index=main in your app or default apps for the above sourcetype (if it exists). You can check this using btool
3. enable the index settings in indexes.conf for index=okta providing correct bucket settings, rollover settings etc.

=========== example below ======

#inputs.conf
[monitor:///mycollection/location/filename]
sourcetype=required_okta_sourcetype
index = okta
blacklist = \.gz$

==

# indexes.conf

    [okta]
    homePath   = volume:home/okta/db
    coldPath   = volume:cold/okta/colddb
    thawedPath = $SPLUNK_DB/okta/thaweddb
    tstatsHomePath = volume:home/okta/datamodel_summary
    frozenTimePeriodInSecs = 34164000
    maxHotBuckets = 10
    maxDataSize = auto_high_volume

[jparct]

Thanks for this suggestion. I will explore this further.

[hardikJsheth · Accepted solution]

One possible solution would be to create a new role , put "okta" as a default index for the role and then assign this role to the users who should be accessing the dashboards.

[jparct]

Thanks to those who answered. I opted to use the new role and set okta as the default index as it was the simplest solution. I will explore the other suggestions as well.