Problem getting a new index in Splunk v4.0.X to work properly

[rnutting24]

Hi,

I just created a new app and wanted to point my network inputs to another index, managed by my app. So, I modified my inputs.conf and indexes.conf files in my $SPLUNK_HOME/etc/apps/MYAPP/local/ directory to use the new index:

indexes.conf:

[custom_index] coldPath = $SPLUNK_DB/custom_index/colddb disabled = 0 homePath = $SPLUNK_DB/custom_index/db thawedPath = $SPLUNK_DB/custom_index/thaweddb

inputs.conf

[udp://20000] index = custom_index disabled = false sourcetype = custom

I restarted Splunk from the WEB UI and from the command line. When I went to see if stuff was indexing in my new index it was, but I didn't see any of the data available to my new app. Permissions are set correctly for the index and when I look at the "Event_count" in the manager window, the number is growing! Is there something I am missing? I am using the free version of splunk (v4.0.6) but I don't believe that has anything to do with my problem. I can use the default "main" index fine but I would like to use my own separate indexes for certain splunk apps. Any help would be appreciated.

Thanks, Ray

[the_wolverine · Accepted solution]

Assuming that the events made it to your custom index, have you verified that you are actually searching on that index?

To be sure, specify the custom index in your search terms:

index=custom_index

Since its a new index it is probably ok to search across "All Time" just to be sure the events are there but maybe improperly timestamped.

If you want to be able to search this custom index by default, you'll need to add it as one of the default indexes to search for the role in question. This is done by editing your authorize.conf file. For example:

[role_user]
srchIndexesDefault = main;custom_index

[rnutting24]

The authorize.conf file was what I was missing. Guess I forgot the most important part 🙂

Thanks for the help!

[gkanapathy]

you can also edit the default indexes for a role in the Manager GUI under "Roles".