Getting Data In

Problem with indexes except main

RezaET
Observer

I installed cisco network add-on, but only main index work and I cannot store log in another index

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Can you be more verbose? What do you mean by "I cannot store log in another index". The TA itself shouldn't have anything to do with the indexes.

0 Karma

RezaET
Observer

first, I created new UDP data input whit a new index "cisco"

but when I search index=cisco there was no event

then I create new UDP data input whit "main" index and I worked.

but I don't like to store my switch event in main index

 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Have you created an index named "cisco" before creating inputs? You can't send events to a non-existent index.

If you haven't, the event will end up either in a last-chance index (if you have one configured) or discarded (and you'll get a warning in _internal about it).

0 Karma

RezaET
Observer

yes, first I cedared index and then input. but it didn't work, only main index work

0 Karma

PickleRick
SplunkTrust
SplunkTrust

That does indeed seem strange because you should be getting events into an index regardless of an add-on. The only things that could make you not see the events would be bad timestamp parsing (but that would happen regardless of destination index), bad timerange you're searching (ditto) or no permissions for the cisco index (but as you're saying you've created the index I'm assuming you've got admin rights here).

Try to run

| tstats count where index=cisco by source sourcetype

over all time and see if you get any results

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @RezaET ,

the issue probably is in the default search path:

by default only the main index is in the default search path and in apps the index isn't specified.

You have two solutions:

  • add the other indexes in the default search path,
  • add the index in all the searches of your app.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...