dashboard show no results, need to change index to "symantec" ?

[danielchung]

I found there is no result shown on anyone of the dashboard. However, I searched sourcetype="sep12:log" and saw there are data coming in. I clicked "Inspect" and found the dashboard is actually searching index "symantec", so I search "index=symantec" and got nothing returned.

Do I need to change the index to "symantec" in data input to make it works? TA is installed on the Splunk server, and SEPM is configured to send syslog to Splunk server.

[o_calmels]

As jwalzerpitt said, you have to change the destination index in the app Set Up in the the manage section.

Olivier

[danielchung]

I'm using Splunk App for Symantec, I cannot modify the saved search or dashboard within this app.
The installation guide do not show anything about modifying index to make it works...so I'm curious if it's necessary or I've missed something.

[jwalzerpitt]

You should be able to go to Manage Apps and select Set up and change the index to symantec. Make sure you're sending your Symantec logs to that index.

[MHibbin]

think you've answered your own question. Unless, you want the data you've already indexed in which case, you need to modify the dashboards (or more likely the saved searches behind the dashboard), and make both the default and symantec indexes available to it.