Not sure what's wrong here. When I try to create any input, the only indexes I can see is history, main and summary. The other add-ons on this instance are showing all the indexes and have a feature to type in the index name if not listed in the dropdown, I can also see all the indexes if I go to settings-->indexes. But 'Splunk Add-on for Microsoft Office 365' does not have that option.
Anyone has seen this issue? I don't have backend access to this server to edit the inputs.conf file
you will only be able to see Indexes which are enabled for your role.
if you have admin access you should see all indexes including custom indexes popping up.
while creating indexes select the role, it should resolve your issue.
I looked at the TA and the rest endpoint it hits to get the index list looks right to me.
to troubleshoot, go to the Search app as that same user and run this search:
| rest /services/data/indexes | fields title *
Do you see only the same 3? history, main and summary?
usually in this app (as many others) there isn't the index= filter in eventtypes so all searches don't run until you modify eventtypes or adding all indexes to the default search path.
This second solution is quicker because you have to intervene only in one point [Settings -- Access Controls -- Roles -- your_role -- Indexes] but gives worse performances.
I prefer to intervene in eventtypes adding the index information (
I don't think this question has anything to do with eventtypes? The create input screen in the office 365 app, has an indexes pulldown. For the OP the only values he sees are history, main and summary but he doesn't know why since he does have other indexes and he sees them listed elsewhere in other apps. Possibly you know some detail leading you to believe there is some involvement with eventtypes?
If you have the app installed on a HF like us, you will need to push a copy of the indexes.conf out to them also.
This ensures that in any apps that use a dropdown for your indexes, it will populate with a list of all your indexes.
We actually have two indexes.conf, one we push only to our IDX's (in case IDX specific settings need to be there) then one copy we push to our HF's.
Yea seems like thats the issue. On most of the add-on, you still have an option to type in the index if it is not listed out in the dropdown. This one is not a fun TA for sure.