topic Re: Confused about the data in Getting Data In

Confused about the data

SLowry — Thu, 29 Nov 2012 16:40:14 GMT

I've enabled Forwarding & Receiving to accept input from the Universal Forwarder that I installed on my servers. Using Wireshark I know data is being sent to the Splunk server. I'm confused about the next steps in terms of indexing the data. Where is it being stored on my server? Do I need to add files on the server? How does the data get to them?

Thanks

Re: Confused about the data

Ayn — Thu, 29 Nov 2012 18:10:37 GMT

You add data inputs on the Universal Forwarders. The forwarders will read data from these inputs and forward that data to the main Splunk indexer. The indexer stores this data in its index, typically in $SPLUNK_HOME/var/lib/splunk, where $SPLUNK_HOME usually is /opt/splunk in *NIX installations and C:\Program Files\Splunk in Windows installations.

Re: Confused about the data

SLowry — Thu, 29 Nov 2012 19:34:39 GMT

OK, I see lots of data in the Main file. That's good.
I have Windows Intelligence & Windows Management Apps installed. How do I tell them to use the Main index? I see Indexes for WI, but they are empty, I don't think that's correct, but I don't know how to get the data to them.

Re: Confused about the data

Ayn — Thu, 29 Nov 2012 19:46:09 GMT

That's a separate question regarding those specific apps - best idea would be to post that on its own and tag it correctly, so people with knowledge of those apps (I don't have that, sorry) can see and respond.

Re: Confused about the data

DaveSavage — Thu, 29 Nov 2012 20:23:20 GMT

Slowry - Ayn is right - post your q's re WI and Windows Mgmt as new q's - the tagging system works in your favour and you will be able to see 'related' if not similar q's people have had. The user experience on the App's release page makes for good reading at http://splunk-base.splunk.com/apps/22315/splunk-app-for-windows
Br, Dave

Re: Confused about the data

SLowry — Fri, 30 Nov 2012 15:12:23 GMT

Thanks. You got me moving in the right direction.