Splunk App for Web Analytics: How to specify a certain index for searches in built-in reports?

[rameshlpatel]

Hi,

All reports by default are not using an index in searches. However, I am using my specific index where all data is stored. How do I point all reports to my index by default?

[Richfez · Accepted solution]

I don't have the app, but as you said the docs for it imply that it's not index specific. That's OK, there are two ways mentioned or implied by the above that may work for your needs. Read both and see which one is better suited toward your needs.

First, try going to Settings/Event types and changing the search string for the event type "web-traffic" to include an "index=myindex ..." at the front of it.

Second, and probably not as effective and more work to keep up (and potentially with more side effects as well) you may be able to set the "default indexes searched" for the user involved to include the index that has this data. Then as long as the sourcetype is set right, it ought to work.

If this resolves your issue, could you please mark this Answered so that others can better rely on it? Thanks!