Index Data Missing

[shangshin]

Hi,
I created a new index location "my_apache" dedicated for a sourcetype "my_apache_access_log"
I am able to see data returns when use any of the two search strings:

index="my_apache"
  index="my_apache" sourcetype="my_apache_access_log"

However, no data is returned when I just entered sourcetype="my_apache_access_log"

Does this mean I have to explicitly enter the index name created by myself?

Another question is how come the sourcetype type ("my_apache_access_log"
) is not listed in the "All index data" dashboard?
Appreciate if anyone can shed some light on this!

[sdaniels · Accepted solution]

Take a look at access controls. Manager » Access controls » Roles » admin

If you look at a role, there are indexes that they have access to and there is a section called "Indexes searched by default". If you add your new index there, it will be searched by default for that role and you won't need to specify the index. Then, it will also show up under all indexed data by default as well.

By the way, for Apache data you should use the Splunk pre-trained sourcetype. The field extractions are all done for you.

http://docs.splunk.com/Documentation/Splunk/latest/Data/Listofpretrainedsourcetypes

[shangshin]

That's the right solution. Thanks!