Security

Index Data Missing

shangshin
Builder

Hi,
I created a new index location "my_apache" dedicated for a sourcetype "my_apache_access_log"
I am able to see data returns when use any of the two search strings:

index="my_apache"
  index="my_apache" sourcetype="my_apache_access_log"

However, no data is returned when I just entered sourcetype="my_apache_access_log"

Does this mean I have to explicitly enter the index name created by myself?

Another question is how come the sourcetype type ("my_apache_access_log"
) is not listed in the "All index data" dashboard?
Appreciate if anyone can shed some light on this!

Tags (1)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

Take a look at access controls. Manager » Access controls » Roles » admin

If you look at a role, there are indexes that they have access to and there is a section called "Indexes searched by default". If you add your new index there, it will be searched by default for that role and you won't need to specify the index. Then, it will also show up under all indexed data by default as well.

By the way, for Apache data you should use the Splunk pre-trained sourcetype. The field extractions are all done for you.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Listofpretrainedsourcetypes

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

Take a look at access controls. Manager » Access controls » Roles » admin

If you look at a role, there are indexes that they have access to and there is a section called "Indexes searched by default". If you add your new index there, it will be searched by default for that role and you won't need to specify the index. Then, it will also show up under all indexed data by default as well.

By the way, for Apache data you should use the Splunk pre-trained sourcetype. The field extractions are all done for you.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Listofpretrainedsourcetypes

shangshin
Builder

That's the right solution. Thanks!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...