Deployment Architecture

How do I set a default search index per app?

Claw
Splunk Employee
Splunk Employee

We have reached a conclusion that a new app should have all of its data in a unique index.

How do I set (or override) the default index for searches under that app?

I understand setting default indexes per role. We could and probably will use specific roles per app. But is there a way to set the index for all searches under that app?

Tags (3)

MarioM
Motivator

one way to get a specific index or sourcetype in any search, if your apps contains searchBar module, is editing the view's xml and adding or modifying <param name="default">index="myappindex"</param>:

    <module name="SearchBar" layoutPanel="mainSearchControls">
    <param name="default">index="myappindex"</param>
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <module name="TimeRangePicker">
        <param name="selected">Last 24 Hours</param>
      <module name="ViewRedirector">
        <param name="viewTarget">flashtimeline</param>
      </module>
    </module>
  </module>

David
Splunk Employee
Splunk Employee

Commonly this is done by making a copy of the flashtimeline view and then editing that parameter. Take a look at the *NIX app for an example.

0 Karma

davecroto
Splunk Employee
Splunk Employee

You could make the changes to the savesearches.conf for all your saved searches in the App. I don't think you can set an index per App like you can in a role.

Get Updates on the Splunk Community!

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...