Deployment Architecture

How do I set a default search index per app?

Splunk Employee
Splunk Employee

We have reached a conclusion that a new app should have all of its data in a unique index.

How do I set (or override) the default index for searches under that app?

I understand setting default indexes per role. We could and probably will use specific roles per app. But is there a way to set the index for all searches under that app?

Tags (3)


one way to get a specific index or sourcetype in any search, if your apps contains searchBar module, is editing the view's xml and adding or modifying <param name="default">index="myappindex"</param>:

    <module name="SearchBar" layoutPanel="mainSearchControls">
    <param name="default">index="myappindex"</param>
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <module name="TimeRangePicker">
        <param name="selected">Last 24 Hours</param>
      <module name="ViewRedirector">
        <param name="viewTarget">flashtimeline</param>

Splunk Employee
Splunk Employee

Commonly this is done by making a copy of the flashtimeline view and then editing that parameter. Take a look at the *NIX app for an example.

0 Karma

Splunk Employee
Splunk Employee

You could make the changes to the savesearches.conf for all your saved searches in the App. I don't think you can set an index per App like you can in a role.

Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...