Splunk Search

Host not showing in search app

priyesh
Explorer

i have 2 splunk servers .

On A splunk server search app i can search host=abc*

But on B splunk server search app when i search host=abc* it shows 0 results but when i add index=xyz it shows data.

Where should i configure in splunk conf files that it should not check for index?

Tags (2)
0 Karma
1 Solution

MHibbin
Influencer

This suggests an inconsistancy in the setup... either:

serverA has been configured to index to the default ("main") index and serverB has not.

OR

serverA has role permissions modified to allow users to search other indexes by default, and serverB has not.

Either way, I believe the simplest solution would to modify the role permissions (unless you want to restart fresh on that server, and potentially lose data... probably not wise) on serverB to allow users to search other indexes by default (i.e. index="xyz" in your case).

This can be done by navigating to the "Manager", as an Admin-type user,which is located in the top right menu bar, then selecting "Access Controls" under "Users and authentication" (bottom-right of the page). Then selecting "Roles", and choosing your desired role (i.e. admin, user, etc). Then towards the bottom of the screen, you can modify the "Indexes searched by default" for that role. You should move index "xyz" to the right-hand box. You may have to logout and back in to apply this.

REF: http://docs.splunk.com/Documentation/Splunk/latest/admin/Addandeditroles#Add_and_edit_roles_using_Sp...

View solution in original post

MHibbin
Influencer

This suggests an inconsistancy in the setup... either:

serverA has been configured to index to the default ("main") index and serverB has not.

OR

serverA has role permissions modified to allow users to search other indexes by default, and serverB has not.

Either way, I believe the simplest solution would to modify the role permissions (unless you want to restart fresh on that server, and potentially lose data... probably not wise) on serverB to allow users to search other indexes by default (i.e. index="xyz" in your case).

This can be done by navigating to the "Manager", as an Admin-type user,which is located in the top right menu bar, then selecting "Access Controls" under "Users and authentication" (bottom-right of the page). Then selecting "Roles", and choosing your desired role (i.e. admin, user, etc). Then towards the bottom of the screen, you can modify the "Indexes searched by default" for that role. You should move index "xyz" to the right-hand box. You may have to logout and back in to apply this.

REF: http://docs.splunk.com/Documentation/Splunk/latest/admin/Addandeditroles#Add_and_edit_roles_using_Sp...

priyesh
Explorer

Thanks 🙂 you solved my problem

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...