Refine your search:

We've done the following so far.

  • Setup a new App through the webui
  • Setup a new index through the webui with the same name as the app
  • Configured a new sourcetype in props.conf and restarted splunk
  • Configured the inputs.conf on a new forwarder to send all alerts to the new index
  • Started up the forwarder and configured it to send events from a file to splunk server specifying the new sourcetype

We're not able to see the events from the search app. I've checked and the index contains the correct number of events. So it looks like the events are being stored but are then not visible. Any ideas what I'm doing wrong?

asked 16 Jan '12, 07:25

srobbins123's gravatar image

srobbins123
211
accept rate: 0%

BTW, people do this all the time. I do this all the time!

(17 Jan '12, 14:14) lguinn ♦

One Answer:

By default, the normal user roles (admin, power, user) only search the main (aka default) index. In fact, the role that you are using might not have permissions to see the new index. In the UI, go to Manager >> Access Controls and edit the role. Be sure to add this index to both the default list of indexes as well as the allowed list of indexes.

If you don't want to add the new index to the default list of indexes searched, you can add

index=xxxx

to your searches to search it explicitly.

HTH!

link

answered 17 Jan '12, 00:39

lguinn's gravatar image

lguinn ♦
10.9k5723
accept rate: 28%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×1,640
×1

Asked: 16 Jan '12, 07:25

Seen: 397 times

Last updated: 17 Jan '12, 14:14

Copyright © 2005-2012 Splunk Inc. All rights reserved.