Splunk Search

Host not showing in search app

priyesh
Explorer

i have 2 splunk servers .

On A splunk server search app i can search host=abc*

But on B splunk server search app when i search host=abc* it shows 0 results but when i add index=xyz it shows data.

Where should i configure in splunk conf files that it should not check for index?

Tags (2)
0 Karma
1 Solution

MHibbin
Influencer

This suggests an inconsistancy in the setup... either:

serverA has been configured to index to the default ("main") index and serverB has not.

OR

serverA has role permissions modified to allow users to search other indexes by default, and serverB has not.

Either way, I believe the simplest solution would to modify the role permissions (unless you want to restart fresh on that server, and potentially lose data... probably not wise) on serverB to allow users to search other indexes by default (i.e. index="xyz" in your case).

This can be done by navigating to the "Manager", as an Admin-type user,which is located in the top right menu bar, then selecting "Access Controls" under "Users and authentication" (bottom-right of the page). Then selecting "Roles", and choosing your desired role (i.e. admin, user, etc). Then towards the bottom of the screen, you can modify the "Indexes searched by default" for that role. You should move index "xyz" to the right-hand box. You may have to logout and back in to apply this.

REF: http://docs.splunk.com/Documentation/Splunk/latest/admin/Addandeditroles#Add_and_edit_roles_using_Sp...

View solution in original post

MHibbin
Influencer

This suggests an inconsistancy in the setup... either:

serverA has been configured to index to the default ("main") index and serverB has not.

OR

serverA has role permissions modified to allow users to search other indexes by default, and serverB has not.

Either way, I believe the simplest solution would to modify the role permissions (unless you want to restart fresh on that server, and potentially lose data... probably not wise) on serverB to allow users to search other indexes by default (i.e. index="xyz" in your case).

This can be done by navigating to the "Manager", as an Admin-type user,which is located in the top right menu bar, then selecting "Access Controls" under "Users and authentication" (bottom-right of the page). Then selecting "Roles", and choosing your desired role (i.e. admin, user, etc). Then towards the bottom of the screen, you can modify the "Indexes searched by default" for that role. You should move index "xyz" to the right-hand box. You may have to logout and back in to apply this.

REF: http://docs.splunk.com/Documentation/Splunk/latest/admin/Addandeditroles#Add_and_edit_roles_using_Sp...

View solution in original post

priyesh
Explorer

Thanks 🙂 you solved my problem

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!