There is a way to configure which indexes belongs which splunk app. Is there also a way to configure in app to tell splunk per default which indexes to search through.
Let's say I have three indexes called:
ix1, ix2, ix3
If I go to the searchbar of this app I would like that splunk is adding a base search:
index=ix1 OR index=ix2 OR index=ix3 <rest_of_the_search_provided_by_the_user> that I don't have to enter everytime all indexes.
Thanks for your advise.