Splunk Search

Index not on searches

DerekKing
Path Finder

Hi,

The app seems to use eventtypes and not specify the index on searches. I can see that all events get forced to the index "ios" but without specifying the index for searching no events are picked up.

I understand splunk only searches "main" if you don't put the index in, so why would the searches in this app not specify index="ios" please ?

I know I must be missing something, but at this point it looks like I have to change every search to include index="ios".

Many Thanks
Derek

0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

1) To which app are you referring?

2) You can adjust the list of indexes searched by default (that is, unless you provide an index= keyword in your search) by visiting the Splunk Manager > Access Controls > Roles > <select role>, then update the list of default indexes. Out of the box, it's only "main".

View solution in original post

sowings
Splunk Employee
Splunk Employee

1) To which app are you referring?

2) You can adjust the list of indexes searched by default (that is, unless you provide an index= keyword in your search) by visiting the Splunk Manager > Access Controls > Roles > <select role>, then update the list of default indexes. Out of the box, it's only "main".

DerekKing
Path Finder

Ahh posted incorrectly. I was referring to CiscoIos, but you have resolved my issue thankyou.

Regards
Derek

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...