Splunk Search

Why am I unable to search from "MAIN" index?

sidtalup27
Explorer

Hello,

I have installed an App, and the data in APP is written to "MAIN" index. When I am search for DATA from the APP, it works fine. Below is the my search query
index="main" source=jira

However, when I search for the same data from Search App, the data is not visible, and hence when I try to create a dashboard, it is not functional.

How can I make data searchable from Search App and from the App. Please advise.

--
Thanks in Advance.
Siddarth

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sidtalup27m,

probably in your search there's something (an eventtype, or a field) that isn't share as global, so you don't see outside the App.

Ciao.

Giuseppe

0 Karma

sidtalup27
Explorer

Hello @gcusello ,

Thank you for your response. Can you please elaborate. How can I fix it.

--

Thanks in Advance
Siddarth

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sidtalup27 ,

What are the searches that run in the app and don't outside?

please share them.

If there are fields or eventtypes, you have to change the permissions on these objects.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...