Why are All indexes not showing up in the UI dropdown when sourcetype is set custom?

[samsign]

our app's addon's Inputs.config  the sourcetype is set to custom name and the index is set to default. shown in below image

In the Add_on install flow .. The UI drop down to pick indexes is showing fewer than what are available

For example below shown indexes are not showing in the list.

The one difference I see is .. these indexes are created with App "_cluster_admin" the other are "search" .. 

How do we enable search option in the available indexes ?

[samsign]

@gcusello  Thanks for the response.  

As an app creater we don't have control on the Indexes available on the Splunk Cloud on user environment.  In App's Input.config we set the index= default.  

during the app install flow the configuration shows the new input stream  .. which index, it should assign to..  .. how can we achieve

• ability to show up all available indexes in the drop down
• If the desired index is not in the available list .. how can we enable user to  input  a string and trigger a search
• If user don't want to pick a index then.. the default should be selected 

Hope you got the clarity on my ask. 

[gcusello]

Hi @samsign,

As I said you have three solutions:

• manually modify the inputs.conf file by SSH,
• create an empty local index on the HF that you can use only for this configuration,
• override the index assignment on the HF (for more details see at https://community.splunk.com/t5/Getting-Data-In/overwrite-index-on-heavy-forwarder-based-on-port/m-p...).

Ciao.

Giuseppe

[gcusello]

Hi @samsign,

I suppose that you are trying to add the index to an Heavy Forwarder and not on Indexer.

If this is your situation, it's normal becase Indexes aren't local on the HF.

You have two solutions:

• manually modify the inputs.conf file by SSH,
• create an empty local index on the HF that you can use only for this configuration.

Ciao.

Giuseppe