All Apps and Add-ons

Configuring app for first time. What index to specify?

Path Finder

I am setting up this app for the first time and planning on ingesting azure logs. The app is installed on my heavy forwarder as I plan to send any data ingested to my indexers for replication and redundancy. How can I specify what index this app should be using? Documentation mentions sourcetypes but not sure if I need to create an index on my indexers or how exactly that will work if I dont specify an index.

0 Karma

Splunk Employee
Splunk Employee

If you do not specify an index, your data will go into "main." If you are just doing a POC, that might be fine. Otherwise, you should create and configure indexes to organize your data in a way that works best for your use case.

Follow the directions here to create indexes and configure their parameters, etc.:

After you have the index configured, you can then select that index when you configure your inputs in the Splunk Add-on for Microsoft Cloud Services (or when you configure any other inputs in other ways too.)

Path Finder

I created essentially a shell named index within the GUI (settings>indexes) on the hvy fwdr box called mscloud within the "Splunk_TA_microsoft-cloudservices app context" so that within the mscloud setup pieces you can choose that index. With forwarding setup correctly, it doesn't go to the local index, but would auto-forward onto the index cluster under the mscloud index name.

0 Karma


Hi santorof,
at first see in the app if there's an indexes.conf file.
If there isn't probably it's in one of the TAs used in the app, so see in documentation if there are mandatory TAs containing indexes.conf.
If you don't find anyone, you can create an index by interface, but in this case, you have to put this index in the default path or better put it in every eventtype of this app.

0 Karma


Can you provide specific location for apps and addons to be present for single instance deployment and for first time.?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...