All Apps and Add-ons

How to change indexes in Splunk Add-on for VMware?

Kendo213
Communicator

This isn't an option through the UI of the application. How do you change the indexes where the data is flowing to?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @Kendo213,

You can change the index in inputs.conf of the application located in etc/apps/your_app_name/[default OR local]/inputs.conf

http://docs.splunk.com/Documentation/Splunk/7.1.1/admin/Inputsconf#GLOBAL_SETTINGS

For vmware performance index - https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @Kendo213,

You can change the index in inputs.conf of the application located in etc/apps/your_app_name/[default OR local]/inputs.conf

http://docs.splunk.com/Documentation/Splunk/7.1.1/admin/Inputsconf#GLOBAL_SETTINGS

For vmware performance index - https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference

Happy Splunking!
0 Karma

Kendo213
Communicator

This doesn't seem to be the case with the Splunk Add-on for Vmware.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Would you mind providing the name of the index you want to change? It will be easy for us then to point to the app and file

Happy Splunking!
0 Karma

Kendo213
Communicator

The sourcetypes are coming in as vmware:perf:*

The index is vmware:perf

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try changing the index in splunk-add-on-for-vmware_342\splunk-add-on-for-vmware_342\Splunk_TA_vmware\default\ta_vmware_collection.conf

Reference : https://docs.splunk.com/Documentation/AddOns/released/VMW/Collectionconfigurationfilereference

Happy Splunking!
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>