Splunk Search

How to set up omit "index=xxx" when searching?

Engager

I log into the web interface using a particular id, and i'm only concerned about a particular index, which is not the default "main" index, right now i have to use "index=xxx" every time i search for something, is there a way to setup my personal web view so that the default searching index for ME is "index=xxx"?

Tags (2)
1 Solution

Influencer

You can assign one or more default indexes to a role. You can find that option in the Splunk Manager under Access controls » Roles.

View solution in original post

Influencer

You can assign one or more default indexes to a role. You can find that option in the Splunk Manager under Access controls » Roles.

View solution in original post

Engager

Thank you very much for your help!

0 Karma