All Apps and Add-ons
Highlighted

Not listing any custom indexes

Explorer

Not sure what's wrong here. When I try to create any input, the only indexes I can see is history, main and summary. The other add-ons on this instance are showing all the indexes and have a feature to type in the index name if not listed in the dropdown, I can also see all the indexes if I go to settings-->indexes. But 'Splunk Add-on for Microsoft Office 365' does not have that option.

Anyone has seen this issue? I don't have backend access to this server to edit the inputs.conf file

0 Karma
Highlighted

Re: Not listing any custom indexes

Contributor

you will only be able to see Indexes which are enabled for your role.
if you have admin access you should see all indexes including custom indexes popping up.
while creating indexes select the role, it should resolve your issue.

0 Karma
Highlighted

Re: Not listing any custom indexes

SplunkTrust
SplunkTrust

I looked at the TA and the rest endpoint it hits to get the index list looks right to me.

to troubleshoot, go to the Search app as that same user and run this search:

| rest /services/data/indexes | fields title *

Do you see only the same 3? history, main and summary?

0 Karma
Highlighted

Re: Not listing any custom indexes

Legend

Hi anoopdi,
usually in this app (as many others) there isn't the index= filter in eventtypes so all searches don't run until you modify eventtypes or adding all indexes to the default search path.

This second solution is quicker because you have to intervene only in one point [Settings -- Access Controls -- Roles -- your_role -- Indexes] but gives worse performances.

I prefer to intervene in eventtypes adding the index information ( index=office365 ).

Bye.
Giuseppe

Highlighted

Re: Not listing any custom indexes

SplunkTrust
SplunkTrust

I don't think this question has anything to do with eventtypes? The create input screen in the office 365 app, has an indexes pulldown. For the OP the only values he sees are history, main and summary but he doesn't know why since he does have other indexes and he sees them listed elsewhere in other apps. Possibly you know some detail leading you to believe there is some involvement with eventtypes?

0 Karma
Highlighted

Re: Not listing any custom indexes

Builder

If you have the app installed on a HF like us, you will need to push a copy of the indexes.conf out to them also.
This ensures that in any apps that use a dropdown for your indexes, it will populate with a list of all your indexes.

We actually have two indexes.conf, one we push only to our IDX's (in case IDX specific settings need to be there) then one copy we push to our HF's.

View solution in original post

Highlighted

Re: Not listing any custom indexes

Explorer

Yea seems like thats the issue. On most of the add-on, you still have an option to type in the index if it is not listed out in the dropdown. This one is not a fun TA for sure.

0 Karma