Splunk Search

Host not showing in search app

priyesh
Explorer

i have 2 splunk servers .

On A splunk server search app i can search host=abc*

But on B splunk server search app when i search host=abc* it shows 0 results but when i add index=xyz it shows data.

Where should i configure in splunk conf files that it should not check for index?

Tags (2)
0 Karma
1 Solution

MHibbin
Influencer

This suggests an inconsistancy in the setup... either:

serverA has been configured to index to the default ("main") index and serverB has not.

OR

serverA has role permissions modified to allow users to search other indexes by default, and serverB has not.

Either way, I believe the simplest solution would to modify the role permissions (unless you want to restart fresh on that server, and potentially lose data... probably not wise) on serverB to allow users to search other indexes by default (i.e. index="xyz" in your case).

This can be done by navigating to the "Manager", as an Admin-type user,which is located in the top right menu bar, then selecting "Access Controls" under "Users and authentication" (bottom-right of the page). Then selecting "Roles", and choosing your desired role (i.e. admin, user, etc). Then towards the bottom of the screen, you can modify the "Indexes searched by default" for that role. You should move index "xyz" to the right-hand box. You may have to logout and back in to apply this.

REF: http://docs.splunk.com/Documentation/Splunk/latest/admin/Addandeditroles#Add_and_edit_roles_using_Sp...

View solution in original post

MHibbin
Influencer

This suggests an inconsistancy in the setup... either:

serverA has been configured to index to the default ("main") index and serverB has not.

OR

serverA has role permissions modified to allow users to search other indexes by default, and serverB has not.

Either way, I believe the simplest solution would to modify the role permissions (unless you want to restart fresh on that server, and potentially lose data... probably not wise) on serverB to allow users to search other indexes by default (i.e. index="xyz" in your case).

This can be done by navigating to the "Manager", as an Admin-type user,which is located in the top right menu bar, then selecting "Access Controls" under "Users and authentication" (bottom-right of the page). Then selecting "Roles", and choosing your desired role (i.e. admin, user, etc). Then towards the bottom of the screen, you can modify the "Indexes searched by default" for that role. You should move index "xyz" to the right-hand box. You may have to logout and back in to apply this.

REF: http://docs.splunk.com/Documentation/Splunk/latest/admin/Addandeditroles#Add_and_edit_roles_using_Sp...

priyesh
Explorer

Thanks 🙂 you solved my problem

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...