All Apps and Add-ons

Changing the default index after installation.

jparct
Explorer

I selected the main index mistakenly during the installation of the Splunk app and add-on for Okta. How do I change this so that the correct index is selected automatically? The index I configured is collecting data as I can specify index=okta in a search and receive current information, it's just that the dashboards aren't displaying the any current information. Splunk 6.6.0 installed on a Ubuntu server.

Thanks.

0 Karma
1 Solution

hardikJsheth
Motivator

One possible solution would be to create a new role , put "okta" as a default index for the role and then assign this role to the users who should be accessing the dashboards.

View solution in original post

0 Karma

koshyk
Super Champion

The best practice for index is the administrator to have overall control over all indexes.conf configuration. What we do is we create a single app with all index configurations and disable index configuration in all other apps.
So in your case, the best way is

  1. In your inputs.conf, ensure you make an entry index=okta in your monitor stanza along && correct sourcetype
  2. Disable any index=main in your app or default apps for the above sourcetype (if it exists). You can check this using btool
  3. enable the index settings in indexes.conf for index=okta providing correct bucket settings, rollover settings etc.

=========== example below ======

#inputs.conf
[monitor:///mycollection/location/filename]
sourcetype=required_okta_sourcetype
index = okta
blacklist = \.gz$

==

# indexes.conf

    [okta]
    homePath   = volume:home/okta/db
    coldPath   = volume:cold/okta/colddb
    thawedPath = $SPLUNK_DB/okta/thaweddb
    tstatsHomePath = volume:home/okta/datamodel_summary
    frozenTimePeriodInSecs = 34164000
    maxHotBuckets = 10
    maxDataSize = auto_high_volume
0 Karma

jparct
Explorer

Thanks for this suggestion. I will explore this further.

0 Karma

hardikJsheth
Motivator

One possible solution would be to create a new role , put "okta" as a default index for the role and then assign this role to the users who should be accessing the dashboards.

0 Karma

jparct
Explorer

Thanks to those who answered. I opted to use the new role and set okta as the default index as it was the simplest solution. I will explore the other suggestions as well.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...