Splunk Search

Why am I unable to search from "MAIN" index?

sidtalup27
Explorer

Hello,

I have installed an App, and the data in APP is written to "MAIN" index. When I am search for DATA from the APP, it works fine. Below is the my search query
index="main" source=jira

However, when I search for the same data from Search App, the data is not visible, and hence when I try to create a dashboard, it is not functional.

How can I make data searchable from Search App and from the App. Please advise.

--
Thanks in Advance.
Siddarth

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sidtalup27m,

probably in your search there's something (an eventtype, or a field) that isn't share as global, so you don't see outside the App.

Ciao.

Giuseppe

Tags (1)
0 Karma

sidtalup27
Explorer

Hello @gcusello ,

Thank you for your response. Can you please elaborate. How can I fix it.

--

Thanks in Advance
Siddarth

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sidtalup27 ,

What are the searches that run in the app and don't outside?

please share them.

If there are fields or eventtypes, you have to change the permissions on these objects.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...