https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25819#M802 <P>I just installed the InterMapper App and once I load the App in Splunk and click on a device, it drills down and displays output from the /opt/splunk/etc/apps/InterMapper/bin/loadImData.py script, every 15 seconds. Is that normal? Is there any way to turn that off?</P> <P>What I see at the tail end of each 172 line entry is:</P> <P>sourcetype=exec source=/opt/splunk/etc/apps/InterMapper/bin/loadImData.py </P> Sun, 05 Aug 2012 22:18:17 GMT jlixfeld 2012-08-05T22:18:17Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25819#M802 <P>I just installed the InterMapper App and once I load the App in Splunk and click on a device, it drills down and displays output from the /opt/splunk/etc/apps/InterMapper/bin/loadImData.py script, every 15 seconds. Is that normal? Is there any way to turn that off?</P> <P>What I see at the tail end of each 172 line entry is:</P> <P>sourcetype=exec source=/opt/splunk/etc/apps/InterMapper/bin/loadImData.py </P> Sun, 05 Aug 2012 22:18:17 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25819#M802 jlixfeld 2012-08-05T22:18:17Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25820#M803 <P>Ok, so I did some digging and I found that there was no index set in $SPLUNK_HOME/etc/apps/InterMapper/default/inputs.conf.</P> <P>I added this to that inputs.conf:</P> <PRE><CODE>[script://$SPLUNK_HOME/etc/apps/InterMapper/bin/cmdPortlookup.py] index = _internal [script://$SPLUNK_HOME/etc/apps/InterMapper/bin/loadImData.py] index = _internal </CODE></PRE> <P>Is there a reason there was no index provided? Is this going to cause any issues if I add one? Will it survive an upgrade or should I put these changes in a different file that isn't overwritten at upgrade time?</P> Sun, 05 Aug 2012 22:50:30 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25820#M803 jlixfeld 2012-08-05T22:50:30Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25821#M804 <P>The script doesn't actually generate any data that is output into Splunk, it actually handles pulling down data from your InterMapper server and then rebuilding your dashboards every 15 seconds. You can adjust this time based on how busy or active your network is but it will affect how often the map image is updated.</P> <P>So, that said. Your change won't survive an update as it shouldn't be outputting anything but I've found the line responsible (debug information that shouldn't still be writing out) and will put up an update tomorrow that fixes it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> All inputs should be correctly identified as sourcetype=InterMapper and these are generated from your syslog notifications from InterMapper.</P> <P>Other than index _internal, you don't really want things to be put into their own indexes, indexes should be used for role based, customer based data separatation or for secure data to reside separately from the rest of your data. There is no added benefit to having many indexes for different apps as if the data levels are too low then you can end up negatively affecting performance.</P> Tue, 07 Aug 2012 03:23:07 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25821#M804 Drainy 2012-08-07T03:23:07Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25822#M805 <P>Update is now up</P> Tue, 07 Aug 2012 12:03:38 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25822#M805 Drainy 2012-08-07T12:03:38Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25823#M806 <P>Amazing! Thanks for the quick turnaround!</P> Tue, 07 Aug 2012 12:48:53 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25823#M806 jlixfeld 2012-08-07T12:48:53Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25824#M807 <P>No worries, feel free to click the tick next to this answer to mark it as accepted so users in the future know <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> And please, feel free to come back with any other questions or use the contact me link on my profile if you had any other specific issues or use cases</P> Tue, 07 Aug 2012 13:38:04 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-pulling-in-the-output-of-the-InterMapper-App-s-loadImData/m-p/25824#M807 Drainy 2012-08-07T13:38:04Z