All Apps and Add-ons

Splunk Add-on for NetApp Data ONTAP: Why doesn't a search that only uses source & source types not work unless i add an index?

Skins
Path Finder

Using a Splunk built app (netapp) where all the searches start with source OR source type.

Now these searches should just work so they are index agnostic correct ? - well they don't, unless I add the index to the searches beforehand.

index=ontap

But that means i have to edit each panel\macro etc to make the searches work.

Am i missing a step ?

gratzi

1 Solution

dauren_akilbeko
Communicator

Yes, you have to add role to your account, this will add index to default search.
http://docs.splunk.com/Documentation/NetApp/2.1.8/DeployNetapp/InstalltheSplunkAppforNetAppDataONTAP
the last step.

To add role to your user go to Settings > Access controls > Users.

View solution in original post

Skins
Path Finder

thanks - i added the role to my account on the HF for data collection but not to the account on the SH

0 Karma

dauren_akilbeko
Communicator

Yes, you have to add role to your account, this will add index to default search.
http://docs.splunk.com/Documentation/NetApp/2.1.8/DeployNetapp/InstalltheSplunkAppforNetAppDataONTAP
the last step.

To add role to your user go to Settings > Access controls > Users.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...