Refine your search:

i have 2 splunk servers .

On A splunk server search app i can search host=abc*

But on B splunk server search app when i search host=abc* it shows 0 results but when i add index=xyz it shows data.

Where should i configure in splunk conf files that it should not check for index?

asked 01 Aug '12, 02:28

priyesh's gravatar image

priyesh
312
accept rate: 0%


One Answer:

This suggests an inconsistancy in the setup... either:

serverA has been configured to index to the default ("main") index and serverB has not.

OR

serverA has role permissions modified to allow users to search other indexes by default, and serverB has not.

Either way, I believe the simplest solution would to modify the role permissions (unless you want to restart fresh on that server, and potentially lose data... probably not wise) on serverB to allow users to search other indexes by default (i.e. index="xyz" in your case).

This can be done by navigating to the "Manager", as an Admin-type user,which is located in the top right menu bar, then selecting "Access Controls" under "Users and authentication" (bottom-right of the page). Then selecting "Roles", and choosing your desired role (i.e. admin, user, etc). Then towards the bottom of the screen, you can modify the "Indexes searched by default" for that role. You should move index "xyz" to the right-hand box. You may have to logout and back in to apply this.

REF: http://docs.splunk.com/Documentation/Splunk/latest/admin/Addandeditroles#Add_and_edit_roles_using_Splunk_Web

link

answered 01 Aug '12, 03:46

MHibbin's gravatar image

MHibbin
3.8k312
accept rate: 31%

Thanks :) you solved my problem

(01 Aug '12, 03:50) priyesh
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×1,646
×138

Asked: 01 Aug '12, 02:28

Seen: 383 times

Last updated: 01 Aug '12, 03:50

Copyright © 2005-2012 Splunk Inc. All rights reserved.