Specify Default Index for App

[David]

How can I specify the default index to use for a specific app?

I have an App with a few inputs defined that put all of their content into an app-specific index, index_myApp. I have a number of reports that all work splendidly, but I also have a flashtimeline where users can run custom searches of the content in that index. When they search there, they get the main index rather than index_myApp. How can I default it to the index containing all of this app's data?

[terry_reece]

You need modify the saved searches for the App so they default to the correct index. You will want to copy the /opt/splunk/etc/apps/unix/default/savedsearches.conf to the /opt/splunk/etc/apps/unix/local directory and modify that version.

The easiest way to accomplish this is to use vi (or whatever editor you prefer) and replace all of the index=os strings to index=NewIndexName, which is UnixGroupA in this case.

For vi, you would use the following:

:%s/index=os/index=UnixGroupA/g

Save the contents of that file and restart Splunk. You can then access the new instance of the app from the Apps menu, and the saved searches will use the correct index for this instance of the app.

There are some other references in various files, such as /opt/splunk/etc/apps/unix2/appserver/static that contains HTML files with references to index=os. Searching through and replacing those to the appropriate index would be a good idea as well.

Also, by default, the search bar and some other items are prepopulated with index=os, that can be changed by modifying the files in /opt/splunk/etc/apps/unix/default/data/ui/views

Use the following commands to modify all the files by replacing index=os with index=UnixGroupA, or index="OS" with index="UnixGroupA"

find . -name "*.xml" -print | xargs sed -i 's/index="os"/index="UnixGroupA"/g'

You can also do this for any other files throughout the app's directories to replace the index=OS or index="OS" strings.

[Mick · Accepted solution]

Similar to how the *nix app prefaces all of it's searches with 'index=os', you can do the same thing with your app. If you are on a *nix instance, take a look at $SPLUNK_HOME/etc/apps/unix/default/data/ui/views/flashtimeline.xml and you will see the following config for the search bar starting on line 11 -

<module name="SearchBar" layoutPanel="splSearchControls-inline">
<param name="q">index=os</param>
<param name="useAssistant">true</param>
<param name="useTypeahead">true</param>
<param name="useOwnSubmitButton">False</param>
...

You can modify your own app's flashtimeline.xml view in the same way

[I_am_Jeff]

On version 4.3.4, I copied the file from the "search" app and added this to the equivalent spot. (I've removed the angle brackets to ensure it appears.)

param name="default" index=myindex /param

I ran "splunk btool fix-dangling" as I use pooled search heads. I had to log out and back in to see the change. ("index=myindex" appears automatically in the search box.) All seems to be working well in the short time it's been modified.

[manikdham]

i used this...but this only limits restriction to the first search...how about making restriction to future searches

[David]

Fun fact I found when testing possible solutions before posting this question: If you define defaultDatabase = myIndex in the indexes.conf for any app, it overrides the global defaultDatabase. This seems like fodder for an excellent prank.

[araitz]

the parameter 'q' is actually deprecated. You should use 'default'.

[David]

Perfect. Thanks!