Seach head and search peer with multiple custom indexes

[Starlette]

Hai there,

I have a indexer with index=a index=b, and a searchead connected to it ( default no changes yet)

When running a search on the searchhead i dont get any events UNLESS i give the index=a with it. I use a user ( as on the indexer) within the role of the "default" indexes

So what do I have to config to get the same defaults? ( meaning I get the summary listing and dont have to enter the index=a index=b etc....)

Thanks!

[I-Man]

For me, the search head wouldn't recognize my custom "Security" index. However if i specified index=security it would find everything. I found that creating another Security Index on the search head itself, splunk wises up and includes it in the search without specifying.

[gkanapathy]

You need to configure indexes "a" and "b" as default indexes for the role that the user belongs to. For most users, only the "main" index is searched unless otherwise specified.