topic Re: Splunk App for Unix and Linux with multiple indexes in All Apps and Add-ons

Splunk App for Unix and Linux with multiple indexes

BrendanMcE — Wed, 11 Jun 2014 14:01:49 GMT

With Splunk App for Unix and Linux, it's is possible to state what indexes will be used.
However is it possible to configure a splunk server that could connect to a number of environments dev,test,live each with the app on but using the splunkforwarder to send it to the central splunk but each of the environments use its own index.

Re: Splunk App for Unix and Linux with multiple indexes

lmyrefelt — Tue, 17 Jun 2014 11:45:03 GMT

Yes, however it might require you to edit some views.

You should take a look at macros.conf to specify your indexes.
example;

[all-indexes]
definition = index=dev OR index=test OR index=live

[dev-index]
definition = index=dev

Call the macros using all-indexes in savessearches.conf and edit the views that might contain hard-references to the "default" os index / search, grep for index=os .

Re: Splunk App for Unix and Linux with multiple indexes

BrendanMcE — Tue, 17 Jun 2014 15:47:37 GMT

So for Splunk App for Unix and Linux
edit the macros.conf on the server
change it to the following
[os_index]
definition = index=dev OR index=test OR index=live
Create a dev,test and live index on the server

The rest of the macros.conf then uses 'os_index'

Then edit the inputs.conf on the forwarder for each environment thus Development will send it to the dev index.
Now for the icing on the cake, set a role called dev with only access to the Dev index. Lets see if this will work.

Re: Splunk App for Unix and Linux with multiple indexes

lmyrefelt — Tue, 17 Jun 2014 16:36:31 GMT

Thats sounds like it should work 🙂