Splunk Search

Search view that only searches on specified index

mplacido
Explorer

Hi,

I'm trying to create a Search view that only searches on the index I specify. But I don't seem to figure out how.
This should be very simple, but I can't find anything on how to do this. Is it possible?

Tags (1)
1 Solution

mplacido
Explorer

After som digging I actually figured it out myself.

I cloned the dasboard view, and added this lines to the xml after the Submit button module parameters.



addterm

myindexname

and then just added the before the Submit module´s

And now every search I make in this view automatically adds index="myindexname" without others seeing it.

View solution in original post

mplacido
Explorer

After som digging I actually figured it out myself.

I cloned the dasboard view, and added this lines to the xml after the Submit button module parameters.



addterm

myindexname

and then just added the before the Submit module´s

And now every search I make in this view automatically adds index="myindexname" without others seeing it.

gkanapathy
Splunk Employee
Splunk Employee

There isn't a totally easy way to do this, other than to construct your view to prepend index=myindex to every base search on the page. This isn't trivial in some cases. Unfortunately, defaulting or restricting automatically is only available to roles, not views. This is a reasonable enhancement request, I think.

jbsplunk
Splunk Employee
Splunk Employee

just start your search with 'index=my_index'

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...