I have an Splunk app named "E-Bark", when I run a query in search bar in this app I can see the results but not when I run that same query in "Search & Reporting".
I want to visualize the results in Grafana but Grafana is fetching data from indices corresponding to "Search & Reporting" only.
Do I need to make any change to the search query?
Sounds to me as if some knowledge objects are scoped to only be visible in your E-Bark app. You can either change visibility for the required knowledge objects to be Global vs. app-only, or you can execute searches using REST using your app's context vs. the S&R app context. Not sure how the Grafana integration works.
@s2_splunk Thanks for helping me with the approach. Can you pls let me know how can the scope of certain indices be changed to Global from app-only.
I recommend you start here.
One thing to note: indexes are not knowledge objects. Access to indexes is configured in role settings. And then there are app permissions as well that may limit what you can and cannot do.
Maybe I am misunderstanding the issue you are having completely.