All Apps and Add-ons

Splunk App for Web Analytics: How to specify a certain index for searches in built-in reports?

rameshlpatel
Communicator

Hi,

All reports by default are not using an index in searches. However, I am using my specific index where all data is stored. How do I point all reports to my index by default?

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

I don't have the app, but as you said the docs for it imply that it's not index specific. That's OK, there are two ways mentioned or implied by the above that may work for your needs. Read both and see which one is better suited toward your needs.

First, try going to Settings/Event types and changing the search string for the event type "web-traffic" to include an "index=myindex ..." at the front of it.

Second, and probably not as effective and more work to keep up (and potentially with more side effects as well) you may be able to set the "default indexes searched" for the user involved to include the index that has this data. Then as long as the sourcetype is set right, it ought to work.

If this resolves your issue, could you please mark this Answered so that others can better rely on it? Thanks!

View solution in original post

Richfez
SplunkTrust
SplunkTrust

I don't have the app, but as you said the docs for it imply that it's not index specific. That's OK, there are two ways mentioned or implied by the above that may work for your needs. Read both and see which one is better suited toward your needs.

First, try going to Settings/Event types and changing the search string for the event type "web-traffic" to include an "index=myindex ..." at the front of it.

Second, and probably not as effective and more work to keep up (and potentially with more side effects as well) you may be able to set the "default indexes searched" for the user involved to include the index that has this data. Then as long as the sourcetype is set right, it ought to work.

If this resolves your issue, could you please mark this Answered so that others can better rely on it? Thanks!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...