Change default index of dashboards

[sigma]

Hi all

I installed and configured the FortiWeb app for Splunk. I also set a desired index on the heavy forwarder (named fortiweb). There is a problem that the predefined dashboards in the app read the information from the main index. I can edit dashboards and add index=fortiweb to each query but it seems not optimal. how can I chnage the main index to fortiweb index?

Thanks

[isoutamo]

Hi

when Apps+TAs have planned and designed to use best practices there are no default index assumptions on those. Usually there is e.g. macro or event type definitions used for those. Then in installation and configuration time that should defined as every deployment want/needs to do it based on their standards.

If/when TAs and Apps didn't follow that practice then you must change those on your installation by your self. Also I suggest that you send feature requirements to the original creator/maintainer to modify these to follow up best practices.

One best practice is: Never ever use main as any purpose! You should always define your own indexes for events based on your local naming etc. standards.

r. Ismo