Index not on searches

[DerekKing]

Hi,

The app seems to use eventtypes and not specify the index on searches. I can see that all events get forced to the index "ios" but without specifying the index for searching no events are picked up.

I understand splunk only searches "main" if you don't put the index in, so why would the searches in this app not specify index="ios" please ?

I know I must be missing something, but at this point it looks like I have to change every search to include index="ios".

Many Thanks
Derek

[sowings · Accepted solution]

1) To which app are you referring?

2) You can adjust the list of indexes searched by default (that is, unless you provide an index= keyword in your search) by visiting the Splunk Manager > Access Controls > Roles > <select role>, then update the list of default indexes. Out of the box, it's only "main".

[DerekKing]

Ahh posted incorrectly. I was referring to CiscoIos, but you have resolved my issue thankyou.

Regards
Derek