How do i search for data from other indexes in the Splunk's search app?
Specify the index name in your search :
index=someindex | ...
you can also edit the role to include other indexes that will be included by default, hence no need to use index=xyz
Damien is correct. If you don't specify an index, you'll search the one named "main". If you want to search all of your indexes, use: index="*"
If you want to search a specific index, use the name in your search: index=myindex
