Splunk Search

how to search in default indexes (not only one) in one app without providing the index.

zugji
Path Finder

Hello folks

There is a way to configure which indexes belongs which splunk app. Is there also a way to configure in app to tell splunk per default which indexes to search through.
Let's say I have three indexes called: ix1, ix2, ix3

If I go to the searchbar of this app I would like that splunk is adding a base search: index=ix1 OR index=ix2 OR index=ix3 <rest_of_the_search_provided_by_the_user> that I don't have to enter everytime all indexes.

Thanks for your advise.

0 Karma

yannK
Splunk Employee
Splunk Employee

Short answer : No.
The index access is controlled by the roles, not by the apps.

You can use a macros specific to the app to prefill your base search, but you will have to find a way to call that macro.
You may want to piggy back on this question for way to script that :
https://answers.splunk.com/answers/521009/in-a-custom-app-dashboard-is-it-possible-to-have-a.html

0 Karma

gcusello
Esteemed Legend

I usually create an eventtype with all indexes and I use it in every search, so in this way I can add or delete an index from my search without modifying all dashboards.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...