Splunk Search

how to search in default indexes (not only one) in one app without providing the index.

zugji
Path Finder

Hello folks

There is a way to configure which indexes belongs which splunk app. Is there also a way to configure in app to tell splunk per default which indexes to search through.
Let's say I have three indexes called: ix1, ix2, ix3

If I go to the searchbar of this app I would like that splunk is adding a base search: index=ix1 OR index=ix2 OR index=ix3 <rest_of_the_search_provided_by_the_user> that I don't have to enter everytime all indexes.

Thanks for your advise.

0 Karma

yannK
Splunk Employee
Splunk Employee

Short answer : No.
The index access is controlled by the roles, not by the apps.

You can use a macros specific to the app to prefill your base search, but you will have to find a way to call that macro.
You may want to piggy back on this question for way to script that :
https://answers.splunk.com/answers/521009/in-a-custom-app-dashboard-is-it-possible-to-have-a.html

0 Karma

gcusello
Esteemed Legend

I usually create an eventtype with all indexes and I use it in every search, so in this way I can add or delete an index from my search without modifying all dashboards.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...