All Apps and Add-ons

Why am I unable to select the custom index created in the indexer?

AL3Z
Path Finder

Hi,

We are using the intsights app for splunk cloud as the intsights app installed on splunk idm,we notice that when we try to create a inputs to get the alerts,we are not able to select the custom index created in the indexer.

Why the all indexes which are present in splunk cloud not populating in the intsights app splunk idm ??

 

Labels (1)
Tags (1)
0 Karma

gcusello
Esteemed Legend

Hi @AL3Z,

indexes created on on-premise Indexers aren't visible on on premise Search Heads, but on Splunk Cloud you should be able to see all Indexes.

Check the grants of the user you're using.

Ciao.

Giuseppe

0 Karma

AL3Z
Path Finder

@gcusello 

We have created the index in splunk cloud only it's not populating in the intsights app

0 Karma

gcusello
Esteemed Legend

Hi @AL3Z,

I suppose that this app is installed in Splunk Cloud, or not?

if on-premise, it's a different thing: it's normal that you don't see it, it's the same thing if you have an Indexer an a Search Head.

In this case you have two solutions: configure the index in the input.conf file, create an empry index with the same name on the on-premise Search Head.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...