Splunk Search

Search view that only searches on specified index

Explorer

Hi,

I'm trying to create a Search view that only searches on the index I specify. But I don't seem to figure out how.
This should be very simple, but I can't find anything on how to do this. Is it possible?

Tags (1)
1 Solution

Explorer

After som digging I actually figured it out myself.

I cloned the dasboard view, and added this lines to the xml after the Submit button module parameters.



addterm

myindexname

and then just added the before the Submit module´s

And now every search I make in this view automatically adds index="myindexname" without others seeing it.

View solution in original post

Explorer

After som digging I actually figured it out myself.

I cloned the dasboard view, and added this lines to the xml after the Submit button module parameters.



addterm

myindexname

and then just added the before the Submit module´s

And now every search I make in this view automatically adds index="myindexname" without others seeing it.

View solution in original post

Splunk Employee
Splunk Employee

There isn't a totally easy way to do this, other than to construct your view to prepend index=myindex to every base search on the page. This isn't trivial in some cases. Unfortunately, defaulting or restricting automatically is only available to roles, not views. This is a reasonable enhancement request, I think.

Splunk Employee
Splunk Employee

just start your search with 'index=my_index'

0 Karma