All Apps and Add-ons

Configuring app for first time. What index to specify?

santorof
Path Finder

I am setting up this app for the first time and planning on ingesting azure logs. The app is installed on my heavy forwarder as I plan to send any data ingested to my indexers for replication and redundancy. How can I specify what index this app should be using? Documentation mentions sourcetypes but not sure if I need to create an index on my indexers or how exactly that will work if I dont specify an index.

0 Karma

rpille_splunk
Splunk Employee
Splunk Employee

If you do not specify an index, your data will go into "main." If you are just doing a POC, that might be fine. Otherwise, you should create and configure indexes to organize your data in a way that works best for your use case.

Follow the directions here to create indexes and configure their parameters, etc.: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/Setupmultipleindexes

After you have the index configured, you can then select that index when you configure your inputs in the Splunk Add-on for Microsoft Cloud Services (or when you configure any other inputs in other ways too.)

Bloodnite
Path Finder

I created essentially a shell named index within the GUI (settings>indexes) on the hvy fwdr box called mscloud within the "Splunk_TA_microsoft-cloudservices app context" so that within the mscloud setup pieces you can choose that index. With forwarding setup correctly, it doesn't go to the local index, but would auto-forward onto the index cluster under the mscloud index name.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi santorof,
at first see in the app if there's an indexes.conf file.
If there isn't probably it's in one of the TAs used in the app, so see in documentation if there are mandatory TAs containing indexes.conf.
If you don't find anyone, you can create an index by interface, but in this case, you have to put this index in the default path or better put it in every eventtype of this app.
Bye.
Giuseppe

0 Karma

securitytweaker
Explorer

@cusello
Can you provide specific location for apps and addons to be present for single instance deployment and for first time.?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...