Problem with indexes except main

[RezaET]

I installed cisco network add-on, but only main index work and I cannot store log in another index

[PickleRick]

Can you be more verbose? What do you mean by "I cannot store log in another index". The TA itself shouldn't have anything to do with the indexes.

[RezaET]

first, I created new UDP data input whit a new index "cisco"

but when I search index=cisco there was no event

then I create new UDP data input whit "main" index and I worked.

but I don't like to store my switch event in main index

[PickleRick]

Have you created an index named "cisco" before creating inputs? You can't send events to a non-existent index.

If you haven't, the event will end up either in a last-chance index (if you have one configured) or discarded (and you'll get a warning in _internal about it).

[RezaET]

yes, first I cedared index and then input. but it didn't work, only main index work

[PickleRick]

That does indeed seem strange because you should be getting events into an index regardless of an add-on. The only things that could make you not see the events would be bad timestamp parsing (but that would happen regardless of destination index), bad timerange you're searching (ditto) or no permissions for the cisco index (but as you're saying you've created the index I'm assuming you've got admin rights here).

Try to run

| tstats count where index=cisco by source sourcetype

over all time and see if you get any results

[gcusello]

Hi @RezaET ,

the issue probably is in the default search path:

by default only the main index is in the default search path and in apps the index isn't specified.

You have two solutions:

• add the other indexes in the default search path,
• add the index in all the searches of your app.

Ciao.

Giuseppe