Configuring app for first time. What index to specify?

[santorof]

I am setting up this app for the first time and planning on ingesting azure logs. The app is installed on my heavy forwarder as I plan to send any data ingested to my indexers for replication and redundancy. How can I specify what index this app should be using? Documentation mentions sourcetypes but not sure if I need to create an index on my indexers or how exactly that will work if I dont specify an index.

[rpille_splunk]

If you do not specify an index, your data will go into "main." If you are just doing a POC, that might be fine. Otherwise, you should create and configure indexes to organize your data in a way that works best for your use case.

Follow the directions here to create indexes and configure their parameters, etc.: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Setupmultipleindexes

After you have the index configured, you can then select that index when you configure your inputs in the Splunk Add-on for Microsoft Cloud Services (or when you configure any other inputs in other ways too.)

[Bloodnite]

I created essentially a shell named index within the GUI (settings>indexes) on the hvy fwdr box called mscloud within the "Splunk_TA_microsoft-cloudservices app context" so that within the mscloud setup pieces you can choose that index. With forwarding setup correctly, it doesn't go to the local index, but would auto-forward onto the index cluster under the mscloud index name.

[gcusello]

Hi santorof,
at first see in the app if there's an indexes.conf file.
If there isn't probably it's in one of the TAs used in the app, so see in documentation if there are mandatory TAs containing indexes.conf.
If you don't find anyone, you can create an index by interface, but in this case, you have to put this index in the default path or better put it in every eventtype of this app.
Bye.
Giuseppe

[securitytweaker]

@cusello
Can you provide specific location for apps and addons to be present for single instance deployment and for first time.?