Splunk Search

make the WAS app index independent

yannK
Splunk Employee
Splunk Employee

I do not want to use the index "websphere" for my data.
Instead of hardcoding index=websphere everywhere,
please use a macro that way we will be able to customize the index list.

example of macro : WAS_index
index=webshpere OR index=myindex OR index=myotherindex

0 Karma

vserebryany
New Member

I am not sure if this is a suggestion or already a solution. If the later I would very much like to see the more detailed explanation. I need to configure univ forwarders across number of cells and i need a flexible scriptable way of directing the inputs app to which index to send the data. Will macro work on UF 5.x. Thanks!

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...