Host not showing in search app

[priyesh]

i have 2 splunk servers .

On A splunk server search app i can search host=abc*

But on B splunk server search app when i search host=abc* it shows 0 results but when i add index=xyz it shows data.

Where should i configure in splunk conf files that it should not check for index?

[MHibbin · Accepted solution]

This suggests an inconsistancy in the setup... either:

serverA has been configured to index to the default ("main") index and serverB has not.

OR

serverA has role permissions modified to allow users to search other indexes by default, and serverB has not.

Either way, I believe the simplest solution would to modify the role permissions (unless you want to restart fresh on that server, and potentially lose data... probably not wise) on serverB to allow users to search other indexes by default (i.e. index="xyz" in your case).

This can be done by navigating to the "Manager", as an Admin-type user,which is located in the top right menu bar, then selecting "Access Controls" under "Users and authentication" (bottom-right of the page). Then selecting "Roles", and choosing your desired role (i.e. admin, user, etc). Then towards the bottom of the screen, you can modify the "Indexes searched by default" for that role. You should move index "xyz" to the right-hand box. You may have to logout and back in to apply this.

REF: http://docs.splunk.com/Documentation/Splunk/latest/admin/Addandeditroles#Add_and_edit_roles_using_Sp...

[priyesh]

Thanks 🙂 you solved my problem