All Apps and Add-ons

Configuring app for first time. What index to specify?

santorof
Communicator

I am setting up this app for the first time and planning on ingesting azure logs. The app is installed on my heavy forwarder as I plan to send any data ingested to my indexers for replication and redundancy. How can I specify what index this app should be using? Documentation mentions sourcetypes but not sure if I need to create an index on my indexers or how exactly that will work if I dont specify an index.

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

If you do not specify an index, your data will go into "main." If you are just doing a POC, that might be fine. Otherwise, you should create and configure indexes to organize your data in a way that works best for your use case.

Follow the directions here to create indexes and configure their parameters, etc.: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Setupmultipleindexes

After you have the index configured, you can then select that index when you configure your inputs in the Splunk Add-on for Microsoft Cloud Services (or when you configure any other inputs in other ways too.)

Bloodnite
Path Finder

I created essentially a shell named index within the GUI (settings>indexes) on the hvy fwdr box called mscloud within the "Splunk_TA_microsoft-cloudservices app context" so that within the mscloud setup pieces you can choose that index. With forwarding setup correctly, it doesn't go to the local index, but would auto-forward onto the index cluster under the mscloud index name.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi santorof,
at first see in the app if there's an indexes.conf file.
If there isn't probably it's in one of the TAs used in the app, so see in documentation if there are mandatory TAs containing indexes.conf.
If you don't find anyone, you can create an index by interface, but in this case, you have to put this index in the default path or better put it in every eventtype of this app.
Bye.
Giuseppe

0 Karma

securitytweaker
Explorer

@cusello
Can you provide specific location for apps and addons to be present for single instance deployment and for first time.?

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...