i want to prefix all searches done in my app with index name. How do i do that.
I use q parameter but that prefixes index name to only the first search. i want to make it a kind of hidden and prefix all searches done in the app with the index name.
I don't think this is currently possible, although you can populate the search bar with a default value, similar to how the Unix app works.
Basically if you edit $SPLUNK_HOME/etc/apps//default/data/ui/views/.xml, you should find an XML module named "SearchBar", and you can add a new param named "q" with the parameter being whatever you want in the search bar for that view.
See $SPLUNK_HOME/etc/apps/unix/default/data/ui/views/about_dashboard.xml as an example.
I don't think this is currently possible, although you can populate the search bar with a default value, similar to how the Unix app works.
Basically if you edit $SPLUNK_HOME/etc/apps//default/data/ui/views/.xml, you should find an XML module named "SearchBar", and you can add a new param named "q" with the parameter being whatever you want in the search bar for that view.
See $SPLUNK_HOME/etc/apps/unix/default/data/ui/views/about_dashboard.xml as an example.
