Splunk Search

[Karthik]

Hello 

I have a query, when i give keyword "error" am getting the data from indexes A & B . But when i want the data from index "c" i need to give the search as "error index=c" then this gives the data of the index c

Can i get the data of all the three indexes A,B & C when i give the word "error"?

Many thanks for the help.

[isoutamo]

Hi

you should always add index to your queries. 
Just write

index IN ( A, B, C) error

to use all three indexes. 
r. Ismo

[Karthik]

Thanks for the reply, but the user is able to get the error logs of the 2 indexes "A & B" when he just give the word "Error" .

So, my user is requesting that he also wants the logs of Index "C" when he type "error". I have given him the solution to use searching for 3 indexes as said below, but, he is asking, when am getting the logs of the 2 indexes which are in the same app, why not the log of the Index "C" which is also in the same app.

So, do we have any possibility to get that done? His key search word ONLY "error" should fetch the logs of all the 3 indexes?

[isoutamo]

Splunk’s best practices is always to use index = in queries. 
The most obvious reason why he get results from those two indexes is that him user role has defined those two as default indexes which are used if no index word is added to query. For that reason I think that quite many administrators will leave this default as empty so users must tell which indexes they want to use.

r. Ismo

https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Authorizeconf

[venkateshparank]

@Karthik 

index IN ( A B C) ERROR

This will give the results from all 3 indexes when ERROR word is visible in events.

or

index=A OR index=B OR index=C ERROR

Even above query also wil give the same results.