Splunk search goes through 'main' index only

[africates]

Hi,

When I try to search anything through either 'Search & Reporting' or 'Splunk App for Windows Infrastructure' I am getting results only from 'main' index.

The same applies to 'Data Summary' - I'm only able to see the hosts which forwarded some events to 'main' index.

Can I change this somehow so search is executed on all indexes apart from these internal ones?

thanks
p

[martin_mueller · Accepted solution]

You could either specify the index(es) you want to search in the search itself:

index=A OR index=B sourcetype=foo ...

Or you can add more indexes to the indexes searched by default for your user's role... which by default only searches index=main. There even is a button for "all non-internal indexes" at Settings -> Authentication -> Roles -> Your Role -> all the way at the bottom