Deployment Architecture

How do I set a default search index per app?

Claw
Splunk Employee
Splunk Employee

We have reached a conclusion that a new app should have all of its data in a unique index.

How do I set (or override) the default index for searches under that app?

I understand setting default indexes per role. We could and probably will use specific roles per app. But is there a way to set the index for all searches under that app?

Tags (3)

MarioM
Motivator

one way to get a specific index or sourcetype in any search, if your apps contains searchBar module, is editing the view's xml and adding or modifying <param name="default">index="myappindex"</param>:

    <module name="SearchBar" layoutPanel="mainSearchControls">
    <param name="default">index="myappindex"</param>
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <module name="TimeRangePicker">
        <param name="selected">Last 24 Hours</param>
      <module name="ViewRedirector">
        <param name="viewTarget">flashtimeline</param>
      </module>
    </module>
  </module>

David
Splunk Employee
Splunk Employee

Commonly this is done by making a copy of the flashtimeline view and then editing that parameter. Take a look at the *NIX app for an example.

0 Karma

davecroto
Splunk Employee
Splunk Employee

You could make the changes to the savesearches.conf for all your saved searches in the App. I don't think you can set an index per App like you can in a role.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...