Hi,
The app seems to use eventtypes and not specify the index on searches. I can see that all events get forced to the index "ios" but without specifying the index for searching no events are picked up.
I understand splunk only searches "main" if you don't put the index in, so why would the searches in this app not specify index="ios" please ?
I know I must be missing something, but at this point it looks like I have to change every search to include index="ios".
Many Thanks
Derek
1) To which app are you referring?
2) You can adjust the list of indexes searched by default (that is, unless you provide an index= keyword in your search) by visiting the Splunk Manager > Access Controls > Roles > <select role>, then update the list of default indexes. Out of the box, it's only "main".
1) To which app are you referring?
2) You can adjust the list of indexes searched by default (that is, unless you provide an index= keyword in your search) by visiting the Splunk Manager > Access Controls > Roles > <select role>, then update the list of default indexes. Out of the box, it's only "main".
Ahh posted incorrectly. I was referring to CiscoIos, but you have resolved my issue thankyou.
Regards
Derek