When I am in default search app and click on an index name the query executed has garbage whitespace embedded. How do I fix this?

[treyka]

I have multiple indexes setup. Most user queries go to my default index however my users typically execute a search on other indexes by going to the search app "home" and clicking the index name in the lower right-hand corner. This populates the search with 'index=[index_name]' however somehow garbage whitespace makes it into the quoted index name. This is really bugging me! This whitespace doesn't appear in any of my config files. Anyone else seeing this behaviour?

[treyka · Accepted solution]

Ah, yes, I forgot that I had modified my dashboard.xml according to this Splunk blog post: http://blogs.splunk.com/2009/07/29/list-indexes-on-the-main-dashboard/

Since a recent update that hack no longer works. If you want to do that hack substitute the following in place of the xml mentioned in Andrea's blog post.

<module name="HiddenSearch" layoutPanel="panel_row2_col1_grp4" group="All indexed data" autoRun="True">
<param name="search">| eventcount summarize=false index=* -count</param>
<module name="SimpleResultsHeader">                                                                                                                                                                                                      
<param name="entityName">results</param>
<param name="headerFormat">Indexes (%(count)s)</param>
</module>
</module>
<module name="Sorter" layoutPanel="panel_row2_col1_grp4">
<param name="sortKey">count</param>
<param name="sortDir">desc</param>
<param name="fields">
<list>
<param name="label">Index</param>
<param name="value">index</param>
</list>
<list>
<param name="label">Count</param>
<param name="value">count</param>
</list>
</param>
<module name="Paginator" >
<param name="count">10</param>
<param name="entityName">settings</param>
<param name="maxPages">10</param>
<module name="SearchLinkLister">
<param name="settingToCreate">list4</param>
<param name="search">| eventcount summarize=false index=* -count</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">index</param>
<param name="value">index</param>
</list>
<list>
<param name="label">count</param>
<param name="labelFormat">number</param>
</list>
</param>
<module name="ConvertToIntention">
<param name="settingToConvert">list4</param>                                                                                                                                                                                             
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="index">$target$</param>
</param>
</param>
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>

[DonD3]

Check out http://answers.splunk.com/answers/73329/add-panel-to-search-home-page-dashboard?page=1&focusedAnswer... for a different approach to listing the indexes.

[gkanapathy]

I am not familiar with any list of name of indexes displayed in the default search app. The default app lists source, sourcetype, and host, but not index. Search results may extract and list the index in the field picker in the lower left. Perhaps you have a customized dashboard of some kind?