|
Hey Answers, I created a new index called bacula. When I search for: "search index=bacula" 0 results show up. However, when I search for: "index=bacula" I get the data as expected. The reason this matters is when I add my query to a dashboard, the dashboard automatically changes the query from "sourcetype=bacula..." to "search sourcetype=bacula..." and nothing shows up. This is all within a app I created, and the index is associated with that app. I also modified the Roles (user and admin so far) to include the bacula index. Is there some addtional permission issues I have missed? Thanks! Mike |
|
|
|
Entering anything in the search field uses the search command. Executing a search with "search" in it (except when required for a subsearch) is asking splunk to look in that index for the word "search" in the data. If any of your events have the word "search" in them somewhere, they would show up in this case. |
Where do you see the dashboard changing the query? Could you show us what lines appear in
$SPLUNK_HOME/var/log/splunk/searches.logwhen you load the dashboard?