All Apps and Add-ons

TA-Canary app presenting data from all indexes

Path Finder


I've had an issue with the TA-Canary app/add-on. I installed both as per instruction, however when I looked at the dashboard presented in the app it was displaying data from a bunch of different indexes that the user had access to as per the role.

My solution was to adjust the macro 'canary_tools_index' to limit it to the specific index these logs are being stored in.

I assume this is the best way to do this?


0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...