Splunk Search

Why am I unable to search from "MAIN" index?

sidtalup27
Explorer

Hello,

I have installed an App, and the data in APP is written to "MAIN" index. When I am search for DATA from the APP, it works fine. Below is the my search query
index="main" source=jira

However, when I search for the same data from Search App, the data is not visible, and hence when I try to create a dashboard, it is not functional.

How can I make data searchable from Search App and from the App. Please advise.

--
Thanks in Advance.
Siddarth

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sidtalup27m,

probably in your search there's something (an eventtype, or a field) that isn't share as global, so you don't see outside the App.

Ciao.

Giuseppe

0 Karma

sidtalup27
Explorer

Hello @gcusello ,

Thank you for your response. Can you please elaborate. How can I fix it.

--

Thanks in Advance
Siddarth

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sidtalup27 ,

What are the searches that run in the app and don't outside?

please share them.

If there are fields or eventtypes, you have to change the permissions on these objects.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...