Using A Custom Index¶

Version 1.2 and later of the Network Toolkit supports the ability to define an index in the URL of the various views that will cause them to do two things:

1. Limit the results searched to the given index
2. Cause the search commands (ping, nslookup, etc) to output to the index

You can do this by simply opening the view with the index parameter. For example, the following URL will limit the pings to the index "network_data":

http://127.0.0.1:8000/en-US/app/network_tools/ping?index=network_data

You can put this in a customized nav in order to direct users to the URL with the index defined. Below is an example of a navigation XML file that restricts each view to the network_data index. This file would be placed in your custom app in the directory "default/data/ui/nav/default.xml" (e.g. "$SPLUNK_HOME/etc/apps/MY_CUSTOM_APP/default/data/ui/nav/default.xml" where your app is named "MY_CUSTOM_APP").

<nav>
  <a href='/app/network_tools/ping?index=network_data'>Ping</a>
  <a href='/app/network_tools/nslookup?index=network_data'>NSlookup</a>
  <a href='/app/network_tools/speedtest?index=network_data'>Speedtest</a>
  <a href='/app/network_tools/traceroute?index=network_data'>Traceroute</a>
  <a href='/app/network_tools/whois?index=network_data'>Whois</a>
</nav>