Hi all,
I've been working on a Data Model, and have a root event with constraint:
`index=test_index`
Now, when I change the constraint to:
`index=prod_index`
In the preview, nothing gets returned.
**1) Can you change the index in the constraint?
2) Also, can you have wildcard in the constrain such as `index="*_index"`?**
There is data in both indexes and I'm using Splunk Enterprise 6.4.2.
Thanks all.
↧