Splunk Search

Index not on searches

Path Finder

Hi,

The app seems to use eventtypes and not specify the index on searches. I can see that all events get forced to the index "ios" but without specifying the index for searching no events are picked up.

I understand splunk only searches "main" if you don't put the index in, so why would the searches in this app not specify index="ios" please ?

I know I must be missing something, but at this point it looks like I have to change every search to include index="ios".

Many Thanks
Derek

0 Karma
1 Solution

Splunk Employee
Splunk Employee

1) To which app are you referring?

2) You can adjust the list of indexes searched by default (that is, unless you provide an index= keyword in your search) by visiting the Splunk Manager > Access Controls > Roles > <select role>, then update the list of default indexes. Out of the box, it's only "main".

View solution in original post

Splunk Employee
Splunk Employee

1) To which app are you referring?

2) You can adjust the list of indexes searched by default (that is, unless you provide an index= keyword in your search) by visiting the Splunk Manager > Access Controls > Roles > <select role>, then update the list of default indexes. Out of the box, it's only "main".

View solution in original post

Path Finder

Ahh posted incorrectly. I was referring to CiscoIos, but you have resolved my issue thankyou.

Regards
Derek

0 Karma