How do you name a splunk index when making the index?

[obesechicken13]

Hi. I'm trying to recreate a splunk index. The index exists in the http search url. https://splunk.mycompany.com/en-US/app/launcher/home

But not in the restapi search head
https://stuff_splunk-search05:8089/services/search/jobs/export

So then I thought, one way to automate getting the data I want from the search head is just to reverse engineer the index from the http search url.
http://dev.splunk.com/view/SP-CAAADQT

The other would be to upload a script to splunk and then run it on a schedule but that's also something I don't know how to do.

I've never made an index. Before I asked someone in my company I just wanted to quickly ask here, how do you set the name of an index? It wasn't too explicit in the instructions.

[obesechicken13 · Accepted solution]

So mr. obesechicken13. It seems your search head does not have the same data as the splunk server has. There's no way to automate getting the data that you want.

[obesechicken13]

thanks mr. obesechicken13

[obesechicken13]

haha. not yet. I'll report back when I solve it.

[Ayn]

Did you solve your issue? Your question confuses me, but if you got it sorted out, great. 🙂

[sdaniels]

You can create indexes in Manager > Indexes. Then when you create inputs you'll assign your newly create index.

http://docs.splunk.com/Documentation/Splunk/latest/admin/Setupmultipleindexes#Create_and_edit_indexe...

[obesechicken13]

Thanks. I don't have permission to access the indexes from there though, and it wouldn't help if I did. I'm using a different account with different permissions through the rest api.