All Apps and Add-ons

Configuring app for first time. What index to specify?

santorof
Path Finder

I am setting up this app for the first time and planning on ingesting azure logs. The app is installed on my heavy forwarder as I plan to send any data ingested to my indexers for replication and redundancy. How can I specify what index this app should be using? Documentation mentions sourcetypes but not sure if I need to create an index on my indexers or how exactly that will work if I dont specify an index.

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

If you do not specify an index, your data will go into "main." If you are just doing a POC, that might be fine. Otherwise, you should create and configure indexes to organize your data in a way that works best for your use case.

Follow the directions here to create indexes and configure their parameters, etc.: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Setupmultipleindexes

After you have the index configured, you can then select that index when you configure your inputs in the Splunk Add-on for Microsoft Cloud Services (or when you configure any other inputs in other ways too.)

Bloodnite
Path Finder

I created essentially a shell named index within the GUI (settings>indexes) on the hvy fwdr box called mscloud within the "Splunk_TA_microsoft-cloudservices app context" so that within the mscloud setup pieces you can choose that index. With forwarding setup correctly, it doesn't go to the local index, but would auto-forward onto the index cluster under the mscloud index name.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi santorof,
at first see in the app if there's an indexes.conf file.
If there isn't probably it's in one of the TAs used in the app, so see in documentation if there are mandatory TAs containing indexes.conf.
If you don't find anyone, you can create an index by interface, but in this case, you have to put this index in the default path or better put it in every eventtype of this app.
Bye.
Giuseppe

0 Karma

securitytweaker
Explorer

@cusello
Can you provide specific location for apps and addons to be present for single instance deployment and for first time.?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...