Deployment Architecture

How do I set a default search index per app?

Splunk Employee
Splunk Employee

We have reached a conclusion that a new app should have all of its data in a unique index.

How do I set (or override) the default index for searches under that app?

I understand setting default indexes per role. We could and probably will use specific roles per app. But is there a way to set the index for all searches under that app?

Tags (3)


one way to get a specific index or sourcetype in any search, if your apps contains searchBar module, is editing the view's xml and adding or modifying <param name="default">index="myappindex"</param>:

    <module name="SearchBar" layoutPanel="mainSearchControls">
    <param name="default">index="myappindex"</param>
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <module name="TimeRangePicker">
        <param name="selected">Last 24 Hours</param>
      <module name="ViewRedirector">
        <param name="viewTarget">flashtimeline</param>

Splunk Employee
Splunk Employee

Commonly this is done by making a copy of the flashtimeline view and then editing that parameter. Take a look at the *NIX app for an example.

0 Karma

Splunk Employee
Splunk Employee

You could make the changes to the savesearches.conf for all your saved searches in the App. I don't think you can set an index per App like you can in a role.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...