Dashboards & Visualizations

How do I change the default index name in the Splunk App for AWS Security Dashboards?

Glasses2
Communicator

Hi - 
I am trying to get the Splunk App for AWS Security Dashboards working.

Apparently the default index the app is using is "main".   I need to change this.

I know I could change the index name by editing the xml but that would require a lot of changes.

I am hoping someone knows where the central change location is located.

 

Thank you.

Labels (2)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @Glasses2,

if you see in the macros pages [Settings -- Advanced search -- Macro], there are some macros addressing the indexes to use in the app.

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @Glasses2,

if you see in the macros pages [Settings -- Advanced search -- Macro], there are some macros addressing the indexes to use in the app.

Ciao.

Giuseppe

chaker
Contributor

Try updating the macro's to reflect the correct index

https://docs.splunk.com/Documentation/AWS/6.0.3/Installation/Macros

Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...