What is the "index" field for in the metadata section after you complete a DB Connect query?

[splunknoob408]

More specifically, what do the available options mean?

I can't find anything online that explains what you're supposed to put there. The available options don't seem to have any relevance to my database schema, which I would expect if it's indexing...

[niketn · Accepted solution]

@splunknoob408, seems like you are setting up DB Connect on fresh installation of Splunk Enterprise as these are default indexes that are created in Splunk. You would want to create a new index for your DB Connect Data (or your Splunk App data, depending on the need).

http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes
OR
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setupmultipleindexes

Unless you have already done so, you should check out the demo videos of setting up DB Connect : https://splunkbase.splunk.com/app/2686/ OR https://www.youtube.com/watch?v=Q1Q3XvChI50

OR the DB Connect Documentation for complete details: http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaseinputs

[splunknoob408]

Thank you, I will read the docs and watch the video. I did a tutorial for DB Connect, but I don't recall it explaining how to create the index -- I think it was already in the list because he was using standard Splunk log data.