topic How to create and configure new indexes in Splunk? in Deployment Architecture

How to create and configure new indexes in Splunk?

vikram_m — Thu, 22 Dec 2016 12:46:51 GMT

Hello team,

My doubts are.
(1) Need to create new Index in Splunk as we have source type, apps which can already be used to differentiate data into Splunk.
(2) Where to configure the Indexes for Splunk as I can see Setting->Indexes and create new index and assign with an app. So what is the next configuration that needs to be carried out with the index newly created?
(3) Please help me if you have any document or artifact which can help me gain insight on Indexes from its reason for creation and configuring indexes please.

Thanks a ton for making me understand the concept.

Re: How to create and configure new indexes in Splunk?

cmerriman — Thu, 22 Dec 2016 13:04:09 GMT

here is a splunk doc that might help:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/Setupmultipleindexes

Re: How to create and configure new indexes in Splunk?

vikram_m — Thu, 22 Dec 2016 13:24:10 GMT

Thanks cmerriman this was very helpful.

Re: How to create and configure new indexes in Splunk?

ddrillic — Sun, 25 Dec 2016 02:12:24 GMT

Please pay attention to this section in the above link at Create custom indexes

This hot portion of this index is called a bucket and we don't want excessive number of them. So, by following these rules we can avoid passing the 50K buckets per index, which is the best practice.

Keep in mind also that the default of maxHotSpanSecs is 86399 seconds, which is a day. For low indexing indexes it can produce lots of buckets, so for such indexes, we can change this value.

Re: How to create and configure new indexes in Splunk?

vikram_m — Tue, 27 Dec 2016 06:05:39 GMT

Thanks ddrillic for the highlight.....I have read the pdf mentioned in the link.....got confidence about Indexes and its use in Splunk.

Next action plan for me is to how do I assign particular host or source or sourcetype to my created custom Index.