Splunk Search

Why am I unable to search from "MAIN" index?

sidtalup27
Explorer

Hello,

I have installed an App, and the data in APP is written to "MAIN" index. When I am search for DATA from the APP, it works fine. Below is the my search query
index="main" source=jira

However, when I search for the same data from Search App, the data is not visible, and hence when I try to create a dashboard, it is not functional.

How can I make data searchable from Search App and from the App. Please advise.

--
Thanks in Advance.
Siddarth

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sidtalup27m,

probably in your search there's something (an eventtype, or a field) that isn't share as global, so you don't see outside the App.

Ciao.

Giuseppe

Tags (1)
0 Karma

sidtalup27
Explorer

Hello @gcusello ,

Thank you for your response. Can you please elaborate. How can I fix it.

--

Thanks in Advance
Siddarth

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sidtalup27 ,

What are the searches that run in the app and don't outside?

please share them.

If there are fields or eventtypes, you have to change the permissions on these objects.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...