Specify Default Index for App

Question

How can I specify the default index to use for a specific app?

I have an App with a few inputs defined that put all of their content into an app-specific index, index_myApp. I have a number of reports that all work splendidly, but I also have a flashtimeline where users can run custom searches of the content in that index. When they search there, they get the main index rather than index_myApp. How can I default it to the index containing all of this app's data?

Accepted Answer

0

Similar to how the *nix app prefaces all of it's searches with 'index=os', you can do the same thing with your app. If you are on a *nix instance, take a look at $SPLUNK_HOME/etc/apps/unix/default/data/ui/views/flashtimeline.xml and you will see the following config for the search bar starting on line 11 -

<module name="SearchBar" layoutPanel="splSearchControls-inline">
<param name="q">index=os</param>
<param name="useAssistant">true</param>
<param name="useTypeahead">true</param>
<param name="useOwnSubmitButton">False</param>
...

You can modify your own app's flashtimeline.xml view in the same way

link

answered 20 Jan '11, 00:32

Mick ♦
4.0k●1●3●27
accept rate: 52%

Perfect. Thanks!

(20 Jan '11, 00:52) David

the parameter 'q' is actually deprecated. You should use 'default'.

(20 Jan '11, 01:07) araitz ♦♦

Fun fact I found when testing possible solutions before posting this question: If you define defaultDatabase = myIndex in the indexes.conf for any app, it overrides the global defaultDatabase. This seems like fodder for an excellent prank.

(20 Jan '11, 01:51) David

Specify Default Index for App

Follow this question

Splunk Resources

Related questions