I can't get splunk for fortigate to use the index where my fortigate data are placed.
When i put index=fortigate before every search the results are comming up perfectly.
my input look like this:
index = fortigate
sourcetype = fortigate
no_ appending_timestamp = true
just to clarify that my data are in index fortigate
You can also check in the App, the eventtypes.conf. You can add the specific index to each eventtype's search. That should quickly fix the issue. Make sure your sourcetype names match what the app is looking for also. Make sure any changes you make, that you put in the local/eventtypes.conf, and dont change the default. (This will keep the changes when you upgrade..)
On a side note, making sure the index is globally searchable is the recommended..
In my recent experience I wanted to do exactly what you described. This is a summary of what I did...
update local/macros.conf section Base Macros definition = index=fortios5 ...
Based on some info I found here:
Also because some dashboards were timing out I needed to update etc/system/local/web.conf to include this setting:
splunkdConnectionTimeout = 120