Deployment Architecture

How do I set a default search index per app?

Claw
Splunk Employee
Splunk Employee

We have reached a conclusion that a new app should have all of its data in a unique index.

How do I set (or override) the default index for searches under that app?

I understand setting default indexes per role. We could and probably will use specific roles per app. But is there a way to set the index for all searches under that app?

Tags (3)

MarioM
Motivator

one way to get a specific index or sourcetype in any search, if your apps contains searchBar module, is editing the view's xml and adding or modifying <param name="default">index="myappindex"</param>:

    <module name="SearchBar" layoutPanel="mainSearchControls">
    <param name="default">index="myappindex"</param>
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <module name="TimeRangePicker">
        <param name="selected">Last 24 Hours</param>
      <module name="ViewRedirector">
        <param name="viewTarget">flashtimeline</param>
      </module>
    </module>
  </module>

David
Splunk Employee
Splunk Employee

Commonly this is done by making a copy of the flashtimeline view and then editing that parameter. Take a look at the *NIX app for an example.

0 Karma

davecroto
Splunk Employee
Splunk Employee

You could make the changes to the savesearches.conf for all your saved searches in the App. I don't think you can set an index per App like you can in a role.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...