All Apps and Add-ons

non-default Index

sov_gwright
New Member

How do I get the App for Web Analytics to look at data in a different index? I made sure to add all non-default indexes to my role and when I search for "index=blah and tag=web" I see all of the correct data with file, site etc fields populated but if I remove "index=blah" no data shows up so Web Analytics isn't seeing the other index.

0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @sov_gwright,
you can have two different approach:

  • modify index search default path for the roles used in your App in [Settings -- Roles -- <your_role> -- Indexes -- Default];
  • modify eventtype web-traffic in your app: copying eventtypes.conf from default to local folder (if not present, create it) and modifying the first eventtype web-traffic adding the indexes to use.

I always prefer the second solution.

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi @sov_gwright,
you can have two different approach:

  • modify index search default path for the roles used in your App in [Settings -- Roles -- <your_role> -- Indexes -- Default];
  • modify eventtype web-traffic in your app: copying eventtypes.conf from default to local folder (if not present, create it) and modifying the first eventtype web-traffic adding the indexes to use.

I always prefer the second solution.

Ciao.
Giuseppe

0 Karma

sov_gwright
New Member

Thanks that worked perfectly - now I'm struggling with Pages and Page Views as it only seems to want to see GET when 99% of our traffic is not GET.

0 Karma

gcusello
Esteemed Legend

Hi @sov_gwright,
good, I'm glad to help you.
about the new question, me or other people in Community will surely help you, but, please create a new request.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...