Hey Answers,
I created a new index called bacula.
When I search for:
"search index=bacula"
0 results show up. However, when I search for:
"index=bacula"
I get the data as expected.
The reason this matters is when I add my query to a dashboard, the dashboard automatically changes the query from "sourcetype=bacula..." to "search sourcetype=bacula..." and nothing shows up.
This is all within a app I created, and the index is associated with that app. I also modified the Roles (user and admin so far) to include the bacula index. Is there some addtional permission issues I have missed?
Thanks!
Mike
... View more