suffic index name to all searches made in the app

[manikdham]

i want to prefix all searches done in my app with index name. How do i do that.
I use q parameter but that prefixes index name to only the first search. i want to make it a kind of hidden and prefix all searches done in the app with the index name.

[adamw · Accepted solution]

I don't think this is currently possible, although you can populate the search bar with a default value, similar to how the Unix app works.

Basically if you edit $SPLUNK_HOME/etc/apps//default/data/ui/views/.xml, you should find an XML module named "SearchBar", and you can add a new param named "q" with the parameter being whatever you want in the search bar for that view.

See $SPLUNK_HOME/etc/apps/unix/default/data/ui/views/about_dashboard.xml as an example.

Thanks,
--adam